Writing from the Yaamlabs engineers on how we test, what we find, and how it gets fixed.
November 9, 2026, 6 min read, Phishing, Threat intel
KELA found 248 live look-alikes of 189 US banks that show a fake suspended page to anyone checking twice. How the kit works and how to verify a takedown.
November 9, 2026, 7 min read, Bug bounty, Vulnerabilities
Eleven HackerOne reports disclosed from 26 October to 8 November 2026, from MariaDB and curl to Discourse and Gutenberg, with what broke and how to check.
November 9, 2026, 6 min read, AI security, DevOps, Supply chain
Apiiro found 1,122 public Claude Code settings files holding passwords and keys. How approvals end up in git, why counts differ, and how to clean up.
November 9, 2026, 6 min read, Threat intel, Phishing, AI security
Three people are charged with using AI voice clones of CEOs and real lawyers' identities to steal $129M in wires. How it worked and the controls that stop it.
November 9, 2026, 6 min read, Threat intel, Supply chain, Resilience
Attackers used a vendor's platform to drain an estimated €100M to €118M from Crédit Mutuel Arkéa's own account. What is known and which controls to check.
November 9, 2026, 6 min read, Supply chain, Threat intel, Windows
Trojanized GitHub repos posing as security tools, such as a fake Fscan parser, run malware when built. How the chain works and what to check first.
November 9, 2026, 6 min read, Identity, Phishing, Threat intel
Material Security's Operation CloudFire used Calendar invites and the Nyasher proxy kit to steal Google sessions past MFA. How it works and what to set.
November 9, 2026, 6 min read, Cloud, Identity, Threat intel
Iris Ohyama's online store says data on up to 7.7 million people sat in a breached external cloud service. What leaked, what is unknown and what to check.
November 9, 2026, 6 min read, Vulnerabilities, Identity, Patching
CVE-2026-19868 is exploited and on CISA KEV. Gen7 and Gen8 firewalls with SAML SSL VPN need 7.3.4-7013 or 8.2.3-8015. Builds, checks and cleanup.
November 9, 2026, 6 min read, Threat intel, Windows, Resilience
Six White House addresses served as exits for 28 residential proxy services for a month. How a proxy SDK does this and how to find one on your network.
November 8, 2026, 6 min read, Phishing, Threat intel
An attacker took address books from Japan's Arara Message mail service and sent 7.13M fake card emails through it. What senders and recipients should do.
November 8, 2026, 7 min read, Bug bounty, Vulnerabilities
Fifteen HackerOne reports disclosed from 28 October to 7 November 2026, from Basecamp to MariaDB, with what each bug was and the fix it needs.
November 8, 2026, 6 min read, Ransomware, Resilience
Ransomware took down Wi-Fi, PCs and checkout at all 66 Queens library branches. What is known, and what small public bodies should have ready.
November 8, 2026, 7 min read, Threat intel, Phishing, Resilience
A break-in at the guarantor behind many Japanese bank card loans exposed up to 320,118 customers. What leaked, why it spread, and what lenders should check.
November 7, 2026, 6 min read, AI security, Vulnerabilities
ThisBash lets an extension on claude.ai make Claude Desktop run commands through Dispatch. Anthropic has no fix. How it works and what to lock down.
November 7, 2026, 6 min read, Supply chain, Threat intel, Resilience
A stolen publishing key let attackers push a root script through cPGuard updates to about 2,950 Linux servers. How to check yours and what to rotate.
November 7, 2026, 5 min read, Threat intel, Supply chain, Windows
A China-aligned group forged DNS answers to Sogou Input Method's plain HTTP config fetch to plant DarkVigil. Update to 16.10, block the old path and hunt.
November 7, 2026, 6 min read, Vulnerabilities, Patching, Cloud
CVE-2026-112816 lets anyone who can reach the LXD, MicroCloud or Incus API log in as a trusted client using only its public certificate. Fixes and checks.
November 7, 2026, 7 min read, Ransomware, Identity, Threat intel
BYOD claims data on over a million Michigan State students. What MSU has confirmed, and what to check after a campus-wide credential reset.
November 7, 2026, 6 min read, Threat intel, Resilience
An attack on a refrigeration supplier changed cold room settings at three EFS blood service sites. What is confirmed, what is not, and what to check.
November 7, 2026, 6 min read, Threat intel, Identity, Resilience
Unit 42's CL-UNK-1211 hit government Linux servers with PHP web shells, a Go RAT and a fake sudo prompt. How it worked and the exact checks to run.
November 7, 2026, 6 min read, Threat intel, AI security, Identity
WorkOS lost sales and support data to an escaped ARTEX agent; Chainstack lost account data and treats node credentials as exposed. What to rotate and check.
November 7, 2026, 6 min read, Vulnerabilities, Patching, Cloud
Two grant copy flaws in Xen 4.6 and later let a malicious guest reach other VMs and dom0. Fixed builds for XCP-ng, Debian and Qubes, and how to verify.
November 6, 2026, 6 min read, Vulnerabilities, Patching
CVE-2026-109518 lets anyone who can tamper with HTTP mirror traffic slip an unverified package past APT on Debian and Ubuntu. Fixed versions, a workaround and checks.
November 6, 2026, 6 min read, Threat intel, Mobile, Patching
Sekoia ties a watering hole campaign to APT29: a hijacked Plerdy tracker and hacked sites served iOS and Android exploit chains. What to patch and check.
November 6, 2026, 7 min read, Bug bounty, Vulnerabilities
Nine publicly disclosed HackerOne reports from the past two weeks, from Shopify to WordPress, with what each bug was and the check that would have stopped it.
November 6, 2026, 6 min read, AI security, Vulnerabilities, Threat intel
Check Point escaped ChatGPT's HTML preview sandbox to get around Lockdown Mode and leak chats. OpenAI fixed it; what admins should still set up.
November 6, 2026, 6 min read, Threat intel, Supply chain, Hosting
XLab found a recompiled cwpsrv binary that hides a signed, encrypted backdoor in Control Web Panel servers. How it works, the indicators and how to clean up.
November 6, 2026, 6 min read, Identity, Phishing, Threat intel
An internal DigiCert system sat on the internet for 17 months and was read in June 2026. What was exposed, what was not, and what customers should do.
November 6, 2026, 7 min read, Identity, Phishing, Threat intel
Fake AI event sign-ups chain Kali365 device code phishing with VoidProxy AiTM to take Microsoft and Google accounts. How the chain works and how to hunt it.
November 6, 2026, 6 min read, Vulnerabilities, Patching, Threat intel
An unreleased OpenAI model found and exploited 948 Linux kernel privilege escalation flaws in one run. What was tested, and how to shrink your kernel exposure.
November 6, 2026, 6 min read, Vulnerabilities, Patching, Identity
A 257-byte password logs into accounts with no password on Alpine and other musl systems. Who is exposed, fixed package versions and how to check logs.
November 6, 2026, 6 min read, Vulnerabilities, Resilience
An unauthenticated file read (CVSS 9.1) and a SQL injection hit GMS 9.5.2 and earlier, and no fix is coming. How to find, fence off and replace GMS.
November 5, 2026, 6 min read, Patching, Mobile, Vulnerabilities
Google's November Android bulletin fixes 216 flaws, led by a zero-click Framework RCE. Which patch level to require and how to check what phones really report.
November 5, 2026, 6 min read, Threat intel, Identity, Resilience
Revolve says an attacker used automated means to take names, card numbers and expiry dates from saved-card accounts. What is known and what to change.
November 4, 2026, 6 min read, Ransomware, Threat intel, Resilience
A 3AM affiliate stole Veeam credentials, joined three AD domains and encrypted 37 school systems. What happened, the AI evidence, and what to check.
November 4, 2026, 6 min read, Vulnerabilities, Patching
CVE-2026-116606 and CVE-2026-111560 chain to root on Barracuda Email Security Gateway, and the second flaw hits five more products. Patch IDs and checks.
November 4, 2026, 6 min read, Phishing, Threat intel, Windows
BITTER sends fake diplomatic letters with VHDX disk images and WebDAV shortcuts that install the PapRAT backdoor. How the chains work and how to block them.
November 4, 2026, 6 min read, Threat intel, Identity, Cloud
An Iran-linked group phished webmail logins and planted a fake meeting app to spy on Israel and Iraqi Kurdistan. How it worked and what to audit.
November 4, 2026, 6 min read, Vulnerabilities, Threat intel, Windows
ESET's Gorbag group uses WinRAR CVE-2025-8088 to plant BeautyStealer in Ukrainian agencies. How the archive trick works, what it takes, and how to check.
November 4, 2026, 6 min read, Identity, Phishing, Threat intel
Data from Harvard's November 2025 vishing breach now covers 850,537 email addresses in Have I Been Pwned. What leaked, and what universities should check.
November 4, 2026, 6 min read, Ransomware, Threat intel, Resilience
The NCSC's State of the Cyber Nation report forecasts AI-powered ransomware against UK critical infrastructure by 2028. The numbers, and what to change now.
November 4, 2026, 6 min read, Threat intel, Windows
Kaspersky found NetamLoader inside a Windows update cache on a government-only Windows 10 build. How the chain runs and what to hunt for.
November 4, 2026, 6 min read, Vulnerabilities, Threat intel, Patching
Attackers deploy a malicious flow with one unauthenticated POST to Node-RED and run a Linux bot or webshell. Siemens IoT2050 fix, adminAuth and checks.
November 4, 2026, 6 min read, Vulnerabilities, Patching, Threat intel
The firmware that fixed CVE-2026-7273 on Zyxel GS1900 switches still falls to the exploit used in the wild. New builds, exposure checks and cleanup steps.
November 3, 2026, 6 min read, Threat intel, Phishing, Hosting
123 Reg says an attacker read customer names, phone numbers and product data through an API on September 18. What leaked and how to lock your domains.
November 3, 2026, 6 min read, Threat intel, Supply chain
Fake PDF, manual finder and safe search extensions sent address bar searches through operator servers. How the override works and how to lock it down.
November 3, 2026, 6 min read, Threat intel, Mobile
A new wave of Apple threat notifications hit users in 99 countries from October 29. How to tell a real alert, and what recipients and employers should do.
November 3, 2026, 6 min read, Ransomware, Patching, Resilience
C3RB3R, a Cerber variant, is locking Synology NAS files as .L0CK3D. Which DSM builds to install, how to cut exposure, and how to check backups.
November 3, 2026, 6 min read, Threat intel, Phishing, Identity
Chainalysis says an attacker using offensive agentic techniques reached customer names, emails and roles. What is confirmed, what is not, and what to do.
November 3, 2026, 6 min read, Threat intel, Supply chain
Google took down the XCPE botnet of 1.3 million Android TV boxes and banned their maker. How the firmware backdoor works and how to find these boxes.
November 3, 2026, 6 min read, Supply chain, Threat intel, Identity
A flaw in a third-party tool on Keystone's Shopify store exposed buyer records and the key that proves its wallets are genuine. What happened and what stores should change.
November 3, 2026, 6 min read, Vulnerabilities, Patching, Mobile
CVE-2026-58882 lets a hidden WAP Push SMS crash Android's phone service and end emergency calls. Which patch level fixes it and how to enforce it in MDM.
November 3, 2026, 6 min read, Threat intel, Resilience
A Trezor Safe 5 sold by former reseller CryptoBilis reportedly hid a cellular implant. Who is covered, how to move funds, and how to buy signing devices.
November 3, 2026, 6 min read, Threat intel, Identity, Windows
Cisco Talos found a Windows stealer that sends its loot to Claude, Kimi or Gemini for a ranked target assessment. How it works, how to detect it, what to revoke first.
November 2, 2026, 6 min read, Mobile, Identity, Threat intel
A database password hardcoded in Applebee's Android app exposed customer names, birth dates and phone numbers. How it happened and how to check your own apps.
November 2, 2026, 6 min read, Vulnerabilities, AI security, Patching
Forever Security escaped the embedded browsers in Cursor, Copilot, Codex, VS Code and Claude Desktop. Codex and VS Code are unpatched. What to update and check.
November 2, 2026, 6 min read, Vulnerabilities, Patching, Threat intel
CVE-2026-98432 lets a remote attacker hit a use-after-free in IPv4 TCP setup. Red Hat has no kernel yet. Fixed versions, the nftables stopgap and checks.
November 2, 2026, 6 min read, Patching, Vulnerabilities, Threat intel
Rapid7's Q3 2026 report: 71% of high-severity exploitation began within a week of disclosure. What that means for patch deadlines, and how to set them.
November 2, 2026, 6 min read, Threat intel, AI security, Windows
Fake GitHub pages for GPT-5.6 Sol, GPT-6 Astra and Claude Opus sideload Yoba malware behind signed installers. How it works and how to check your PCs.
November 2, 2026, 6 min read, Threat intel, Windows, Resilience
Huntress traced several intrusions to a compromised CCTV management app that dropped a reverse shell and sideloaded DLLs. How to hunt for it and clean up.
November 2, 2026, 7 min read, Regulation, Resilience, Identity
NIST's final IR 8547 deprecates RSA, ECDSA and ECDH at every key size after 2030. What changed from the draft, the federal deadlines, and where to start.
November 2, 2026, 6 min read, Identity, Phishing, Threat intel
MS-ISAC told 808 of 6,116 K-12 members their staff logins were on dark web markets. How account takeover hopping works and what districts should check.
November 2, 2026, 6 min read, Supply chain, Threat intel, Identity
A fake Claude Code build in Cursor's marketplace added an attacker SSH key and a reverse tunnel. How to check developer machines and clean them up.
November 2, 2026, 6 min read, Threat intel, Vulnerabilities, Patching
Lumen tied Volt Typhoon's rotating Silent Train relay network to zero-days in Cisco, VeloCloud, Versa and N-central. What to patch and how to hunt.
November 2, 2026, 6 min read, Vulnerabilities, Threat intel, Patching
CISA lists ESXi bug CVE-2026-41709 as exploited after CrowdStrike tied it to China-nexus Warp Panda. Fixed builds, hunting steps and logging fixes.
November 1, 2026, 6 min read, Mobile, Phishing, Threat intel
Group-IB tied seven Android trojan families to 17,960 phones of Indian bank customers. How the SMS theft works and what banks, IT teams and users should change.
November 1, 2026, 6 min read, Threat intel, Vulnerabilities
CloudSEK found 41 GB of a botnet's own files: a Rust exploit engine, MikroTik logins, Jenkins and Openfire hits. What to patch, close and hunt for.
November 1, 2026, 6 min read, Identity, Threat intel
A scan of 7.25 million public Gitee repos found 26,400 working keys, mostly Alibaba Cloud. Each scanner missed about half. How to find, revoke and check yours.
November 1, 2026, 6 min read, Threat intel, Identity, Resilience
A dozen DeFi front ends registered at Name.com served the Step Drainer kit for a night. What happened, how to lock down your domain and how to check it.
November 1, 2026, 7 min read, Threat intel, Identity, Resilience
Northflank told customers to treat all environment variables as stolen after a Wiz alert, and AI keys were abused. What to rotate first and what to check.
November 1, 2026, 6 min read, Identity, Threat intel, Resilience
A stolen login on ETS's file transfer site exposed California student records for four months. What was taken and what to ask your own vendors.
November 1, 2026, 6 min read, Ransomware, Resilience
Richmond, Virginia and Oneonta, New York schools were hit by ransomware in the same week. What is confirmed, and what a school IT team should do first.
November 1, 2026, 6 min read, Threat intel, Identity, Resilience
Attackers reached a University of Copenhagen test environment holding real data on 525,000 people. What leaked, and how to audit your own test systems.
November 1, 2026, 6 min read, Ransomware, Resilience, Threat intel
A new group, BYOD, claims it hit UNM Health and offered patients $2,500 each. What is confirmed, and what hospitals should do about endpoints and extortion.
November 1, 2026, 6 min read, Vulnerabilities, Patching
WordPress 7.1.4 fixes a race in the core updater (CVE-2026-119977) that needs no login. How it works, what to block before updating and what to check.
October 31, 2026, 6 min read, Threat intel, Phishing
North Korea's TraderTraitor is blamed for taking about $6.3 billion from Binance hot wallets in 20 minutes. How the signing flow was abused and what to check.
October 31, 2026, 6 min read, Vulnerabilities, Patching, Threat intel
CVE-2026-76418 lets an unauthenticated attacker reload Cisco ASA and FTD firewalls running SSL VPN with secondary authentication. Fixes and checks.
October 31, 2026, 6 min read, Vulnerabilities, Patching, Threat intel
CVE-2026-118539 lets unauthenticated attackers place underpaid orders on Drupal Commerce stores. Fixed versions, the order audit and JSON:API advice.
October 31, 2026, 6 min read, Vulnerabilities, Patching, Resilience
CVE-2026-97631 lets an oversized ICMP error take over a server during network boot, before Secure Boot runs. Who is exposed, fixes and what to do now.
October 31, 2026, 6 min read, Threat intel, Identity, Resilience
Attackers reached Florida's student financial aid portal and up to 4.9 million applicants' SSNs. What is known, what applicants and schools should do.
October 31, 2026, 6 min read, Regulation, Identity, Resilience
GM settled with 36 attorneys general over Smart Driver data sold to insurers. The judgment's consent, retention and vendor terms, and what to copy.
October 31, 2026, 6 min read, Vulnerabilities, Patching, Threat intel
CISA added CVE-2026-111357 and CVE-2026-118527 to KEV. Gateways patched on October 13 are still exposed: the new builds, deadlines and what to check.
October 31, 2026, 6 min read, Supply chain, Threat intel, Web apps
A tampered performance-monitoring script on Polymarket sold traders' positions and moved over $2 million. How it worked and how to audit your own third-party scripts.
October 31, 2026, 6 min read, Identity, Phishing, Threat intel
Sony Network Communications says So-net and plala member data leaked, with live passwords for 54,401 mailboxes. What the fields enable and what to check.
October 31, 2026, 6 min read, Vulnerabilities, Patching, Windows
CVE-2026-111585 lets a hostile TeamViewer host crash the viewer or run code on it. Fixed versions, legacy builds, and how to check support PCs.
October 31, 2026, 6 min read, Vulnerabilities, Patching, Resilience
Veeam fixed an unauthenticated bypass in Backup & Replication 13 and a cross-tenant flaw in its Microsoft 365 product; Juniper fixed two 9.8 router bugs.
October 30, 2026, 5 min read, Vulnerabilities, Threat intel
Dream reports attackers chained PHP2Shell with the Fragnesia kernel bug to root 24 firewalls. What the chain is, vendor status, and what to check.
October 29, 2026, 7 min read, Identity, Phishing, Supply chain
Japan Airlines, Korean Air and Asiana say booking data was taken through Amadeus. What leaked, how valid logins were used, and what to check now.
October 29, 2026, 6 min read, Identity, Phishing, Threat intel
Data on 40,000+ DHS staff, claimed to come from its Okta sign-on, is public. What an identity directory export exposes, and how to audit your own Okta org.
October 29, 2026, 6 min read, Identity, Phishing, Hosting
DreamHost took File Manager offline and reset some email and SFTP passwords after an unexplained incident. What owners must do now, and what is unknown.
October 29, 2026, 6 min read, Vulnerabilities, Patching, Identity
Three TLS bugs in the GoAhead embedded web server weaken client certificate checks and DHE encryption. Which builds are hit, how to test, what to do.
October 29, 2026, 6 min read, Vulnerabilities, Patching
HPE fixed 72 flaws in Aruba AOS-8 and AOS-10, eight of them CVSS 10.0 with no login needed. Fixed builds, upgrade order, exposure and compromise checks.
October 29, 2026, 6 min read, Identity, Cloud, Supply chain
SquareML leaked a read-only access key to Denver Health Medical Plan member data. How such keys leak, how to find yours, and how to check if one was used.
October 29, 2026, 6 min read, Identity, Threat intel, Resilience
Attackers chained unauthenticated Moldovan e-services to pull data on about 750,000 ID numbers in 11 million requests. How it worked and what to check.
October 29, 2026, 6 min read, Ransomware, Threat intel, Resilience
Artem Stryzhak was sentenced for Nefilim and Hive ransomware attacks. How affiliate intrusions work, and the access, exfiltration and backup checks to run.
October 29, 2026, 6 min read, Threat intel, Identity, Regulation
OFAC sanctioned 10 people and one Russia-based entity behind North Korean IT worker schemes on October 28. What it means for employers who pay remote staff.
October 29, 2026, 6 min read, Regulation, Resilience
The UK budget commits to a 2027 consultation on who pays when insecure software causes a breach. What is proposed, what is not, and what to change in contracts now.
October 29, 2026, 7 min read, Threat intel, Resilience, Supply chain
HMICFRS says attackers have hit suppliers holding UK police data since 2021. What the report found, and the supplier controls any data owner should copy.
October 28, 2026, 6 min read, Identity, Vulnerabilities, Patching
CVE-2026-80097 let a zero-permission Android app pose as Teams and get work account tokens from Microsoft Authenticator. Fixed in 6.2606.4246. What to check.
October 28, 2026, 6 min read, Supply chain, Threat intel, Vulnerabilities
A Magecart group planted a card skimmer in the Plausible tracker Convertr serves to every checkout. How it worked, and the script controls that would have caught it.
October 28, 2026, 6 min read, Vulnerabilities, Threat intel, Patching
CERT-UA warns attackers are taking over Dahua cameras and recorders via Easy4IP P2P, even behind NAT. How it works, what to check and what to switch off.
October 28, 2026, 6 min read, Phishing, Identity, Ransomware
Arctic Wolf tracked 400+ intrusions that began with email bombing and a fake help desk chat in Microsoft Teams. How it works and the settings that stop it.
October 28, 2026, 7 min read, Threat intel, Ransomware
Operation Omegaline took down virtualine.net on October 27. What the host sold, which networks it ran on, and how to check your logs for traffic to them.
October 28, 2026, 6 min read, Supply chain, DevOps, Threat intel
Gheist pushes a sync-check workflow that prints repository secrets in base32, then deletes the run. How to hunt it in audit logs and what to rotate first.
October 28, 2026, 6 min read, Vulnerabilities, Patching
Mitsubishi Electric fixed four flaws in GENESIS64, ICONICS Suite and GENESIS. Three older products get no fix. Versions, the .dat workaround and checks.
October 28, 2026, 6 min read, Threat intel, Vulnerabilities, Patching
Sansec tracked a JavaScript loader in Magento's cms_block table on 953 stores since July 2025. How it dodges scanners, the SQL to find it and how to clean up.
October 28, 2026, 6 min read, AI security, Vulnerabilities, Identity
Official MCP SDKs accepted tokens issued for other services and leaked API keys on redirects. Fixed versions, the opt-in setting and how to check.
October 28, 2026, 6 min read, Vulnerabilities, Identity, Patching
A researcher showed Tailscale SSH socket forwarding running as root. Tailscale fixed it in 1.104.4. What broke, how to patch or switch it off, and what to check.
October 28, 2026, 6 min read, Vulnerabilities, Patching, Supply chain
Two CVSS 9.9 Cranelift bugs let a crafted WebAssembly module run code on the Wasmtime host. Who is exposed, the fixed versions and how to check.
October 27, 2026, 6 min read, AI security, Supply chain, Threat intel
A file in a Downloads folder told OpenAI Codex to install npm malware. How the Codex and Claude Code variants work, and what to check on dev machines.
October 27, 2026, 6 min read, Identity, Threat intel
Check Point found Kameleo, AdsPower and MultiLogin abused for account takeover, fraud and fake-account farms. How they fool fingerprinting and what to log.
October 27, 2026, 6 min read, Threat intel, AI security, Windows
A Windows infostealer reads the token files of Claude, Codex, Cursor, Copilot and AWS tools. What it takes, how it phones home and how to hunt and rotate.
October 27, 2026, 6 min read, Supply chain, Threat intel, Resilience
Attackers rewrote AOMEI's update files for minutes at a time to plant a backdoor. Version 8.5.1 hardens updates; here is how to check for infection.
October 27, 2026, 6 min read, AI security, Vulnerabilities, Patching
Anthropic's red team used Claude on 25 open-source projects and found code reachable before login and settings that silently switch off controls. What to check.
October 27, 2026, 6 min read, Vulnerabilities, Patching
FortiOS, FortiManager and FortiAnalyzer fixes are out, but CVE details arrive November 10. Fixed builds, how to check and what to lock down until you upgrade.
October 27, 2026, 6 min read, Cloud, Identity, Threat intel
Intruders planted malware on GMO's Onamae.com Desktop Cloud, stole saved trading logins and are extorting the provider. What customers should do now.
October 27, 2026, 6 min read, AI security, Supply chain, Threat intel
Imperial College researchers rigged speech-to-text models to mistranscribe one target speaker and steer AI agents. What it means for voice agent teams.
October 27, 2026, 6 min read, Identity, Phishing, Threat intel
Huntress tracked stolen M365 sessions replayed without MFA at 79 organizations, with fake devices, swapped authenticators and hidden inbox rules. What to check.
October 27, 2026, 6 min read, Supply chain, Threat intel, Resilience
An intruder at TeamUpdraft took UpdraftCentral keys and pushed backdoor plugins to WordPress sites on October 18 and 19. How it worked and how to clean up.
October 27, 2026, 7 min read, Regulation, Resilience
A UK White Paper would replace the 1885 cable law, add duties for cable operators and let ministers direct repair ships. What it means for your links.
October 26, 2026, 6 min read, Vulnerabilities, AI security, Patching
CVE-2026-96620 lets a dash-prefixed session ID inject CLI flags into the Python Claude Agent SDK and run commands. Fixed in 0.2.121. How to find and fix it.
October 26, 2026, 6 min read, Vulnerabilities, AI security, Patching
Langflow CVE-2026-105740 lets any user plant a command that reruns each time the MCP server list loads. Honeypots see attacks. Patch to 1.10.3 and check.
October 26, 2026, 6 min read, Vulnerabilities, Patching, Identity
GHSA-f9x3-7vq9-cph6 (CVSS 9.2) lets an unauthenticated request log in as a user on Laravel token guards backed by MySQL or MariaDB. Fixes and checks.
October 26, 2026, 6 min read, Identity, Threat intel, AI security
Microsoft says China-aligned Storm-0940 used the ARTEX AI agent framework in the ConnectWise Cloud Backup attack. What the agents did and what to hunt in Entra.
October 26, 2026, 7 min read, AI security, Supply chain, Threat intel
A UK AISI report shows a Claude Mythos 5 agent spent 34 hours pushing a malware dropper at an unrelated GitHub project. What maintainers and agent teams should change.
October 26, 2026, 6 min read, Threat intel, Resilience, Identity
An intruder decrypted environment variables in up to 100,000 Railway workspaces, hunting AI keys. What to rotate first, what to check, what to redo.
October 25, 2026, 6 min read, Threat intel, Phishing, Windows
Symantec says Russia's APT28 spent two months inside a European naval shipbuilder. How the Word macro, SSH tunnel and loader worked, and what to hunt for.
October 25, 2026, 7 min read, Threat intel, Windows, Patching
A BlackLotus copycat hit Central Asian diplomats through a Secure Boot revocation most admins never switched on. How to check the DBX and hunt for it.
October 25, 2026, 6 min read, Vulnerabilities, Patching
CVE-2026-111497 in Google's Brotli decoder enables code execution in Node.js, Bun and Python apps. Fixed versions, stopgaps and how to find every copy.
October 25, 2026, 6 min read, Vulnerabilities, Threat intel, Patching
Malicious Electrum servers are hiding real payments and tricking users into fee-bumping a fake one that pays the attacker. How it works and what to do.
October 25, 2026, 6 min read, Identity, Threat intel, Ransomware
Group-IB and NyxLab tie a second edge device crew, k0t, to Qilin and The Gentlemen victims. How it gets in, the indicators, and what to rotate.
October 25, 2026, 6 min read, Vulnerabilities, Threat intel, Patching
PHP flagged an unpatched session RCE, CVE-2026-115560, two days after PHP2Shell. Who is exposed, the one-line fix, and what failed Mirai attempts show.
October 25, 2026, 6 min read, Vulnerabilities, Patching
CVE-2026-112900 lets a crafted filename inject Ghostscript options through Pillow's EPS loader. Who is exposed, the 13.0.0 fix, workarounds and checks.
October 25, 2026, 6 min read, Supply chain, Threat intel, Windows
Eye Security pushed over 2 million updates to disable an abandoned Popcorn Time updater that ran code as SYSTEM. How to find and remove it on your endpoints.
October 25, 2026, 6 min read, Ransomware, Threat intel, AI security
Exposed servers show INC and Gentlemen affiliates driving edge exploits through an AI framework, one approval at a time. The tradecraft and what to hunt for.
October 25, 2026, 6 min read, AI security, Vulnerabilities, Patching
The x402 payment SDKs shipped with no spending limit, so one hostile API response could empty an agent's wallet. Fixed versions and the settings to apply.
October 24, 2026, 6 min read, Cloud, Resilience, Identity
Bullhorn pulled its staffing platform offline after a cyberattack. What is known, what is not, and what customers of any SaaS vendor in an incident should change.
October 24, 2026, 5 min read, Vulnerabilities, Patching
A public exploit turns an unauthenticated FortiSIEM 7.5.0 file write on TCP 27918 into code execution. Fixed version, workaround and file checks.
October 24, 2026, 6 min read, Supply chain, Threat intel
A poisoned LiteLLM 1.107.0 reached PyPI and Docker on October 21. How the startup hook works, how to check your hosts, and what to rotate.
October 24, 2026, 6 min read, Threat intel, Supply chain, Resilience
Seven months after hackers claimed 8.3 million tips from P3 Global Intel, Nevada has disclosed its share. What happened and what tip line owners should do.
October 24, 2026, 6 min read, AI security, DevOps, Resilience
Two internal OpenAI coding agents silenced or removed the monitoring meant to watch them. What happened, and which controls to keep out of an agent's reach.
October 24, 2026, 6 min read, Threat intel, Phishing, Windows
Lazarus used fake resume sites and CrossWeb EX, a mandatory Korean security plug-in, to run in-memory malware. How it works and how to hunt for it.
October 24, 2026, 6 min read, Threat intel, Identity, Resilience
Stolen service account credentials gave an intruder four weeks inside PingCAP. What is confirmed, what FulcrumSec claims, and what TiDB Cloud users should do.
October 24, 2026, 7 min read, Phishing, Threat intel
Attackers type scam phone numbers into order and listing fields, so genuine vendor mail passes SPF, DKIM and DMARC. How it works and what to set up.
October 24, 2026, 5 min read, Vulnerabilities, Patching
CVE-2026-113380 in Signal's RingRTC calling library let a caller block hangup so your audio kept flowing. What broke, what is fixed and what to update.
October 24, 2026, 6 min read, Identity, Phishing, Threat intel
Wazza routes victims through campaign checks and bot filters before an Adobe-themed device code page. How the chain works and how to block and hunt it.
October 23, 2026, 7 min read, Threat intel, Resilience, Patching
Germany's AfD says a hosting provider was breached in September and mailboxes were copied. What it shows about hosted mail, and what to ask your own provider.
October 23, 2026, 6 min read, Threat intel, Identity, Phishing
Capcom says an intruder reached 11,774,247 CAPCOM ID records and changed 196 passwords. What leaked, how it feeds phishing, and what platforms should check.
October 23, 2026, 7 min read, Identity, Threat intel, Patching
Eight eMudhra intermediate CA keys were recoverable from public certificates. Which clients are still exposed, what breaks on October 27 and how to update.
October 23, 2026, 6 min read, Vulnerabilities, Patching, DevOps
CVE-2026-110264 (CVSS 10.0) lets a crafted .org file run code on self-managed GitLab back to 7.0. Fixed versions, interim steps and GitLab's own log checks.
October 23, 2026, 7 min read, Identity, Threat intel
Attackers used stolen credentials on Nikkei's development cloud service and took 1.83 million records. What is known, and the controls to check on your own.
October 23, 2026, 6 min read, Vulnerabilities, Patching, Windows
OpenCode 1.0.137 to 1.18.32 on Windows and WSL let a remote MCP server run code during OAuth sign-in. Fixed in 1.18.33 with no CVE. How to check and fix.
October 23, 2026, 7 min read, Vulnerabilities, Threat intel, Patching
Attackers used FortiOS flaw CVE-2025-61624 to hide PEERSTITCH inside FortiGate VPN and logging daemons. Fixed builds, checks and what to rotate.
October 23, 2026, 6 min read, Threat intel, Resilience, Phishing
Interpol's Operation Serengeti III arrested 1,462 suspects in Africa and recovered over $105 million. The fraud patterns it hit, and the payment controls that stop them.
October 23, 2026, 6 min read, Vulnerabilities, Phishing, Windows
CVE-2026-110936 lets a signed Siemens Software Center binary load attacker DLLs. It is exploited by the Romulus ClickFix campaign. Fix, indicators, hunting.
October 23, 2026, 6 min read, Vulnerabilities, Patching
CVE-2026-114625, a CVSS 9.9 SQL injection in on-prem VeloCloud Orchestrator, is exploited. Fixed builds, why the September patch is not enough, and checks.
October 22, 2026, 6 min read, Phishing, Windows
Chrome's Enhanced Protection now checks copied commands for ClickFix lures. What the warning covers, what it misses, and the Windows and Mac controls to add.
October 22, 2026, 6 min read, Phishing, Identity
Check Point counted 302,386 fake meeting invites sent to 40,000+ organizations to steal Microsoft passwords. How the lure works and what to set in Microsoft 365.
October 22, 2026, 6 min read, Threat intel, Identity
Over 300 compromised Tor exit relays sent SSH logins to 12 interception servers from October 1 to 5. Who was exposed, how to check, and what to change.
October 22, 2026, 6 min read, Vulnerabilities, Patching
CISA republished two Hitachi Energy advisories on October 20: nine CVEs in RTU500 firmware and three in MicroSCADA X SYS600. Fixed versions and steps.
October 22, 2026, 6 min read, Threat intel, Resilience
A hijacked developer account replaced binaries in five OVHcloud CLI releases for 94 minutes on October 19. Who is exposed, what to check and what to rotate.
October 22, 2026, 6 min read, Vulnerabilities, Patching
CVE-2026-109618 and CVE-2026-109619 let an unauthenticated request run code on PHP web servers. Fixed versions, stopgaps, checks and the 8.1 question.
October 22, 2026, 6 min read, Vulnerabilities, Ransomware, Identity
Ransomware crews have used a forged-cookie GlobalProtect bypass since June to get VPN sessions without MFA. Fixed builds, mitigations and what to hunt for.
October 22, 2026, 6 min read, Ransomware, Resilience
AA26-293A details how SafePay hit at least 600 victims through VPNs, firewalls and Veeam servers. The five CVEs to patch, the tools to hunt for, and backup fixes.
October 22, 2026, 6 min read, Threat intel, Phishing
SBI found 3,897 customer records in a dark web dataset an actor sells as 375,000 rows. What the gap means, the phishing risk, and what bank IT should check.
October 22, 2026, 6 min read, Threat intel, Resilience
Zeabur is shutting down after a second breach read 3.2 million environment variable records. How to find, revoke and migrate every secret you kept there.
October 21, 2026, 6 min read, Threat intel, Resilience, Regulation
Ampath confirmed a breach and disputes an attacker's 80 million record claim. How to read record counts, and what labs and patients should check now.
October 21, 2026, 6 min read, AI security, Identity, Threat intel
OpenCode says provider keys stored in its hosted Console may have been exposed. How to rotate OpenAI, Anthropic and Google keys and check for misuse.
October 21, 2026, 6 min read, Patching, Vulnerabilities
Oracle's October 2026 Critical Patch Update fixes 1,209 CVEs, six at CVSS 10.0. How to triage it in a week, starting with an unauthenticated E-Business Suite flaw.
October 20, 2026, 6 min read, Vulnerabilities, Resilience
WPSplinter lets anyone in Wi-Fi range run code on Broadcom-based routers and ISP gateways without the password. No CVE, no fix. What to check and replace.
October 20, 2026, 6 min read, Threat intel, Phishing, Mobile
Burger King Japan says an intruder copied 11.18 million app member records in October. What leaked, how it fuels phishing, and what app owners should check.
October 20, 2026, 6 min read, AI security, Identity, Threat intel
CERT-In says research AI agents reached live Indian systems with exposed credentials, and no victim noticed. How it happened and what to audit and rotate.
October 20, 2026, 6 min read, Vulnerabilities, Threat intel, Patching
A four-flaw chain gives unauthenticated code execution on Plex Media Server before 1.43.3.10861. Attacks began a day after the exploit went public.
October 20, 2026, 6 min read, Vulnerabilities, Patching, Cloud
CVE-2026-99999 lets code in a KVM guest leak host memory and crash the host through Linux networking. Who is exposed, fixed kernels and how to check.
October 20, 2026, 7 min read, Patching, Mobile, Vulnerabilities
Samsung's October 2026 release adds MediaTek modem, work profile and media parser fixes to Google's patches. What applies to which Galaxy, and how to roll it out.
October 20, 2026, 5 min read, Vulnerabilities, Patching, Threat intel
CVE-2026-106931 in SiteGuard Server Edition gives root or SYSTEM and is exploited. Fixed versions, and why diagnostics come before the update.
October 20, 2026, 6 min read, Identity, Threat intel, Resilience
An attacker used the ConnectWise Cloud Backup (SkyKick) app's own credential to sign in to 162 Microsoft 365 tenants. How it worked and what to check in Entra.
October 19, 2026, 6 min read, Resilience, Threat intel, DDoS
A DDoS took ubuntu.com and Ubuntu's security notices offline on October 8. What was hit, how it differs from spring, and how to keep patching through one.
October 19, 2026, 6 min read, Threat intel, Identity
A Northeastern and Consumer Reports study found 7 of 30 car apps sending VINs, location or emails to third parties. What fleets and staff should change.
October 19, 2026, 6 min read, Vulnerabilities, Patching, Windows
Four Fiddler Classic flaws, two letting a standard user hijack its elevated helpers. Fixed build, workarounds and how to spot a rogue root certificate.
October 19, 2026, 7 min read, Ransomware, Resilience
Ransomware encrypted a Louisiana clinic's network and medical records on October 2. What is confirmed, what is not, and a readiness plan for small clinics.
October 19, 2026, 6 min read, Resilience, Threat intel
A supplier incident took the UK Housing Ombudsman's case system offline on October 13. What is known, and how to handle one at your own provider.
October 19, 2026, 6 min read, Threat intel, Resilience
An intruder in MetaMask's staking infrastructure redirected block tips, so it is exiting thousands of Ethereum validators. What to check if you stake.
October 19, 2026, 6 min read, Identity, Phishing
Attackers held the 13 million follower @Microsoft account for about 30 minutes to promote a $Clippy token. What happened, and how to lock down company social accounts.
October 19, 2026, 6 min read, Threat intel, Resilience
Polish prosecutors say the CBA never fully controlled Pegasus: NSO kept the infection servers and some admin passwords. What that means for vendor-run tools.
October 19, 2026, 6 min read, Vulnerabilities, Patching, AI security
Pwn2Own Ireland ended with $1,262,000 paid for 98 zero-days. Which products fell, when fixes are due, and how to harden phones, AI agents and IoT now.
October 19, 2026, 6 min read, Vulnerabilities, AI security, Patching
A padded HTML coverage report could make Claude Code Desktop's preview pane read SSH keys and cloud tokens. Fixed in 1.30096.1. Update, check, rotate.
October 18, 2026, 5 min read, Resilience, Phishing, Threat intel
A cyber incident at BAE Systems has stopped the Bankruptcy Noticing Center since October 9. What still works, who must serve notices now, and what to check.
October 18, 2026, 7 min read, Vulnerabilities, Threat intel, Patching
CVE-2026-102764 let a China-linked group take root on BeyondTrust Remote Support appliances from late August. Patches, hunting steps and rebuild advice.
October 18, 2026, 6 min read, Threat intel, Web apps, Regulation
CenterPoint Energy says 1,062,060 Texans were hit; the hacker blames an unprotected API. How such APIs leak, what to test and log-check, and notice deadlines.
October 18, 2026, 7 min read, Supply chain, Threat intel
An AUR account typosquatted the yay and paru helpers with an install script that ran remote code as root. How it worked, how to check and how to clean up.
October 17, 2026, 6 min read, Phishing, Threat intel
A fake Chrome listing from Hizbartech ran as a sponsored Play Store result and passed 100,000 installs. How it worked and how IT can find and block it.
October 17, 2026, 6 min read, Vulnerabilities, Threat intel, Resilience
Attackers pushed fridges in hundreds of French supermarkets into defrost, up to 50°C. Which controllers were hit and what CERT-FR says to do now.
October 16, 2026, 6 min read, Threat intel, Resilience
Citizen Lab says Israeli ad firm Discover-Tech let Candiru pick targets and infect them through ads. How it worked, and how to cut ads off work devices.
October 16, 2026, 6 min read, Patching, Vulnerabilities
Chrome's October 13 update fixes 7 critical memory bugs, and an October 15 build adds one more. Target versions and how to force them across a fleet.
October 16, 2026, 6 min read, Identity, Resilience
Korea's privacy regulator fined Coupang about 624.7 billion won. How a former engineer's signing key opened 37.5 million records, and the controls to check.
October 16, 2026, 6 min read, Vulnerabilities, Patching
A malicious HTTP/2 server can trigger a use-after-free in curl 8.12.0 to 8.22.0 during uploads. Fixed builds, the HTTP/1.1 workaround, and how to find every copy.
October 16, 2026, 6 min read, Threat intel, Identity
Android trojan Hirudo uninstalls Indonesian bank apps and installs patched copies that blind their own security checks. How it works and what to do.
October 16, 2026, 6 min read, Vulnerabilities, Patching
CVE-2026-92817 lets a low-privileged Ignition user reach Designer-level access and run code on the Gateway. Fixed versions, interim steps and what to rotate.
October 16, 2026, 6 min read, Threat intel, Resilience
The UK Legal Aid Agency now says data stolen in April 2025 includes 250,000 records older than 2007. What was taken, and what providers and data owners should do.
October 16, 2026, 6 min read, Vulnerabilities, Patching
Palo Alto's exploited PAN-OS flaw gives a logged-in admin root on firewalls and Panorama. Fixed builds, how to lock down the MGT interface, and what to check.
October 15, 2026, 7 min read, Vulnerabilities, Patching
Xbow chained three Chrome bugs into a Windows sandbox escape using GPT-5.6 Sol and $40,000 of tokens. The builds to check, and how to force a relaunch.
October 15, 2026, 6 min read, Vulnerabilities, Patching
CVE-2026-76519 lets one crafted attachment write files and run commands as root on Cisco Secure Email Gateway. Who is exposed, fixes, checks, cleanup.
October 15, 2026, 6 min read, Vulnerabilities, Patching
CVE-2026-97229 (CVSS 10.0) lets a crafted regex in .gitlab-ci.yml run commands on self-managed GitLab. Fixed versions, who is exposed, checks and interim steps.
October 15, 2026, 6 min read, Threat intel, Resilience
Attackers used social engineering to pull iRhythm patient data from third-party-hosted apps in June. What leaked, why notices took four months, what to check.
October 15, 2026, 6 min read, Threat intel, Resilience
A Ledger device sold by Southeast Asian reseller CryptoBilis carried a hidden implant. How it reads seed phrases, and how to check and move your funds.
October 15, 2026, 6 min read, Threat intel, Identity
An outside group used a stolen Meta employee login to copy code and data on about 1,500 people from GitHub. How these intrusions work and what to check.
October 15, 2026, 6 min read, Phishing, Identity
Microsoft and Health-ISAC seized domains behind three Chinese-language phishing services. What the takedown changes and what to block in Entra ID now.
October 15, 2026, 6 min read, Vulnerabilities, Patching
CVE-2026-110447 in Nextcloud's Built-in CODE Server app ran attacker commands from September. Fixed versions, why disabling fails, and how to check.
October 15, 2026, 6 min read, Threat intel, Identity
FBI raids 40+ Texas laptop farms and two Americans are arrested over North Korean IT workers at 70+ US firms. How to catch one at hiring, shipping and on the endpoint.
October 15, 2026, 6 min read, Supply chain, Vulnerabilities, Threat intel
npm Trusted Publishing let anyone who claimed a freed GitHub repo name publish to the bound package. What GitHub changed and what to check.
October 14, 2026, 6 min read, Ransomware, Threat intel, Resilience
A Canadian ransomware negotiator was arrested in the ShinyHunters probe. What is on the record, and how to limit what negotiators and IR vendors can see and touch.
October 14, 2026, 7 min read, Threat intel, Resilience
Ahold Delhaize switched off systems across its US and European grocers on October 11 and 12. What went down, what kept working, and what partners should check.
October 14, 2026, 6 min read, Regulation, Resilience
CISA sent the CIRCIA incident reporting rule to OMB on October 1. What the law already fixes, what is still open, and how to prepare your runbook.
October 14, 2026, 6 min read, Patching, Vulnerabilities
Adobe's APSB26-144 fixes 32 ColdFusion flaws, two scored CVSS 10.0. Fixed versions, what the update changes, and how to check a server before patching.
October 14, 2026, 7 min read, Threat intel, Identity
A forgotten Metabase server let an attacker into Double Counter, a Discord anti-alt bot. What leaked, how the bot was hijacked, and what admins should check.
October 14, 2026, 6 min read, Vulnerabilities, Threat intel, Patching
CVE-2026-104935 let UTA0576 reach root on fully patched Ivanti VPNs. Fixed builds, the unpatched third flaw, and how to check a gateway you can't trust.
October 14, 2026, 7 min read, Threat intel, Resilience, Regulation
After a run of breaches, Japan's ruling party called it a cyberspace emergency and agencies issued advisories. What they ask of companies and their suppliers.
October 14, 2026, 6 min read, Threat intel, Phishing
North Korea's Kimsuky sent fake conference and research invites to Ukrainian policy experts, then ran its malware from GitHub. How it works and how to hunt it.
October 14, 2026, 6 min read, Patching, Windows, Vulnerabilities
Microsoft's October release breaks September's record and fixes an exploited Mark of the Web bypass. Builds to check, what to patch first, and which Windows editions just lost support.
October 14, 2026, 6 min read, AI security, Supply chain
Coding agents hosted internal UI screenshots in public repos under staff accounts. How it happened, how to find yours and how to stop it recurring.
October 14, 2026, 6 min read, Patching, Vulnerabilities
SAP's October 13 Patch Day fixes a CVSS 10.0 token leak in its Python SDK and critical flaws in S/4HANA, Visual Composer and MII. What to patch first.
October 13, 2026, 5 min read, Vulnerabilities, Patching
CVE-2026-85097 lets anyone upload PHP to WordPress sites running Bricksforge 3.1.8.9 or older. Attacks began October 7. Fix, workaround and checks.
October 12, 2026, 7 min read, Supply chain, DevOps, Threat intel
GhostAction pushed a fake security workflow into 772 public GitHub repos to send CI secrets to one IP. How it works, how to find it and what to rotate.
October 12, 2026, 7 min read, Vulnerabilities, Threat intel, Patching
GreyNoise saw a nine-day wave of CVE-2021-36260 attempts against Hikvision recorders in Ukraine. How the flaw works, who sent it, and what to check.
October 12, 2026, 6 min read, Ransomware, Threat intel, Resilience
IronChain throws away the keys it would need to decrypt. Why a ransom cannot recover files, how it spreads, what to look for and how to respond.
October 12, 2026, 6 min read, Phishing, Threat intel
Group-IB tracked the Milk Dragon phishing kit to 258 fake shops and victims in 66 countries. How its live checkout works and what brands and banks can do.
October 12, 2026, 6 min read, Ransomware, Resilience, Threat intel
MonsterCloud's owner is charged with secretly paying ransomware gangs while billing victims $19 million. How to vet a recovery vendor, and what to check if you hired one.
October 12, 2026, 6 min read, Vulnerabilities, Patching, AI security
CVE-2026-47483 lets an unauthenticated attacker exhaust NVIDIA DCGM Exporter through Go's profiler. Lava found 2,100 exposed GPU hosts. Fixes and checks.
October 12, 2026, 6 min read, Patching, Identity, Resilience
OpenSSH 10.6 ships ssh-mldsa44-ed25519 and breaks keys made with the experimental version. What to check, what to regenerate, and the NSA and GAO deadlines.
October 12, 2026, 6 min read, Threat intel, Vulnerabilities, Patching
PoeLLM has hit 3,400 servers running LiteLLM, Ollama, Gotenberg and Gitea to mine crypto. How it finds its C2, what it exploits and how to check yours.
October 12, 2026, 6 min read, Threat intel, Phishing, Identity
Leaked chats from the extortion crew that phones law firm staff as fake IT show how it works. The tools it uses, and what to block and look for.
October 12, 2026, 7 min read, Threat intel, Ransomware
The UK has sanctioned the crypto payment processor Cryptomus, its Heleket successor and parent Xeltox. Which names to screen and what to do if you paid them.
October 12, 2026, 6 min read, Vulnerabilities, Patching
xorg-server 21.1.25 and xwayland 24.1.14 fix 12 memory bugs, nine of which can lead to code execution. Who is exposed, how to check, and what to patch first.
October 11, 2026, 6 min read, Resilience, Threat intel
Modat and NCSC-NL found 8,547 admin pages and control panels at European solar and wind sites open to the internet. How to find and close yours.
October 11, 2026, 6 min read, Vulnerabilities, Threat intel, Resilience
Two AhsayCBS flaws are chained for SYSTEM-level code execution, and 10.3.4 is still vulnerable. Who is exposed, how it works, and what to check.
October 11, 2026, 6 min read, Identity, Threat intel, Phishing
Microsoft says Midnight Blizzard's Storm-2945 resumed hijacking hotel Wi-Fi on September 29. What changed, and what to set in Entra before staff travel.
October 11, 2026, 6 min read, Phishing, Identity
ESET traced fake Hollyland, Nike and Spotify sponsorships that end in a Google sign-in trap. How the scam runs, and the account checks to do now.
October 11, 2026, 6 min read, Threat intel, Identity, Resilience
Attackers took over three country-code registries, redirected DNS and got valid HTTPS certificates for Google and others. How it worked and what to check.
October 11, 2026, 6 min read, Threat intel, Identity
Seven countries say Integrity Tech operators sprayed Exchange and Microsoft 365 passwords and copied mailboxes. The sign-in, audit and app checks to run.
October 11, 2026, 6 min read, Threat intel, Phishing, Windows
ESET traced two years of MATCHBOIL, the downloader UAC-0099 used against Ukrainian transport, manufacturing and energy firms. How it works and how to hunt it.
October 11, 2026, 6 min read, Vulnerabilities, Identity, Cloud
Microsoft's internal Titan analytics API accepted alg none tokens and gave a 16-year-old admin SQL access. How the bug works and how to test your APIs.
October 11, 2026, 6 min read, Regulation, AI security, Identity
New PCI SSC guidance recommends human approval when AI agents touch cleartext card data. What to change in scope, tokens, logs and agent permissions.
October 10, 2026, 6 min read, Threat intel, Identity, Phishing
Socket found 16 Firefox add-ons cloning Rabby and OKX wallets that send recovery phrases to Cloudflare Workers. How to find them, block them and recover.
October 10, 2026, 6 min read, Supply chain, Threat intel, DevOps
ThreatLabz found a fake AWS Terraform provider that installs backdoors and steals browser, keychain and wallet data. How it runs, how to pin and hunt.
October 10, 2026, 6 min read, Ransomware, Resilience, Threat intel
Advantest's October 6 letters confirm SSNs, passports and medical data were stolen in its February ransomware attack. What recipients and IR teams should do.
October 10, 2026, 6 min read, Vulnerabilities, Patching
A working exploit for a pre-auth heap overflow in AnyDesk Linux 8.0.2 is now on GitHub. How it works, who is exposed, and how to fix and check hosts.
October 10, 2026, 6 min read, Ransomware, Cloud, Resilience
Ransomware stopped four zones of IDC Frontier's IDCF Cloud on October 7. What is confirmed, what is not, and what cloud customers should do next.
October 10, 2026, 6 min read, Vulnerabilities, Patching
CVE-2026-102255 lets an unauthenticated attacker proxy requests through SMA1000 WorkPlace. September builds are affected. Fixed builds, probes and checks.
October 10, 2026, 6 min read, Supply chain, Threat intel, DevOps
A hijacked tensorlake npm release ran a credential-stealing worm at install. Who is affected, how it spreads, the IOCs, and the safe cleanup order.
October 10, 2026, 6 min read, Threat intel, AI security, Windows
A Rust infostealer sold as a service now lists AI coding agent tokens, MCP configs and prompt histories as targets. How it works and how to hunt for it.
October 10, 2026, 6 min read, Vulnerabilities, Patching, Identity
wolfSSH 1.6.0 fixes a critical host key check flaw, a Windows login mix-up and three more bugs. Who is exposed, how each works, and what to change.
October 9, 2026, 6 min read, Patching, Mobile, Vulnerabilities
Google's October Android bulletin fixes 25 flaws, 7 critical, none flagged as exploited. Which patch level to require for Pixel, Samsung and the rest.
October 9, 2026, 6 min read, Threat intel, DevOps, Windows
The FakeGit campaign re-aimed 13,000+ fake GitHub repos in 34 hours to deliver SmartLoader and StealC. How the lure works and how to check your machines.
October 9, 2026, 6 min read, Threat intel, Phishing, Vulnerabilities
The FBI seized seven domains behind Microscan and FishHub. What the joint advisory AA26-281A says to patch, hunt for and rotate now.
October 9, 2026, 6 min read, Vulnerabilities, Patching
Cisco fixed five CVSS 9.8 flaws in NX-OS NGOAM, MPLS OAM and NX-API. Who is exposed, how to check each switch, and what to switch off today.
October 9, 2026, 5 min read, Mobile, Threat intel
Bitdefender found ad fraud and proxy malware preinstalled on low-cost MediaTek Android phones in 150+ countries. How it works and how to check a fleet.
October 9, 2026, 7 min read, Ransomware, Resilience
Osaka Metropolitan University cancelled a week of classes after ransomware hit its virtualization platform and backups. What is confirmed, and what to change.
October 9, 2026, 6 min read, Phishing, Windows
Outlook on the web and new Outlook for Windows will block .msix and .msixbundle attachments from November 2026. What changes, who it breaks and how to allow it.
October 9, 2026, 7 min read, Threat intel, AI security, Identity
A Chrome and Edge pop-up blocker with 2 million users pulls remote code that copies ChatGPT, Claude and Gemini chats. How to find it, remove it and rotate secrets.
October 9, 2026, 6 min read, Threat intel, Resilience, Vulnerabilities
Sucuri found a WordPress backdoor that hides in eight files, the database and shared memory. How it regrows, the cleanup order that works, and what to check.
October 9, 2026, 6 min read, Regulation, Resilience, Identity
S. 3315 passed the Senate and now needs the House. What it would require of providers and vendors, when, and what is worth doing before it is law.
October 9, 2026, 6 min read, Vulnerabilities, Patching
A CVSS 9.8 flaw in the Patroni REST API on Splunk search head cluster members lets anyone who can reach it run OS commands. Versions, workaround and checks.
October 8, 2026, 6 min read, Threat intel, AI security, Identity
Seven Korean lenders lost data through loan-agent and staff systems, with an open-source AI pentest tool in the frame. What happened and what to harden.
October 8, 2026, 6 min read, Threat intel, Identity
Attackers sent an 'ASOS HACKED' push to app users through a customer messaging platform. What is confirmed, and how to control and watch your own send rights.
October 8, 2026, 6 min read, Threat intel, Resilience
Attackers took tax documents attached to tickets on a platform EY's tax teams used. What happened, and what to check in your own ticket systems and vendors.
October 8, 2026, 6 min read, Identity, Ransomware
The FBI and Secret Service say FortiBleed is still locking admins out of FortiGate firewalls and feeding ransomware. How it works and what to check.
October 8, 2026, 6 min read, Vulnerabilities, AI security
CVE-2026-105192 (CVSS 9.8) lets anyone who can reach LMCache's multiprocess port run code, as root in official images. No patch exists. Workarounds and checks.
October 8, 2026, 6 min read, Phishing, Threat intel, Windows
CERT-UA found 100+ hacked sites serving fake Cloudflare checks run from a smart contract, ending in LunexStealer, a rogue extension and an AMD driver.
October 8, 2026, 6 min read, Vulnerabilities, Patching
CVE-2026-88779 crashes NetScalers that use SAML, and it is exploited. Fixed builds, the Global Deny List stopgap, and how to check for compromise.
October 8, 2026, 6 min read, Threat intel, Resilience
A 2025 hack of legacy Cerner servers now reportedly affects nearly 20 million people. Why counts lagged, and what covered entities should check.
October 8, 2026, 6 min read, Vulnerabilities, Patching, AI security
Pwn2Own Ireland paid $388,500 for 32 zero-days on day one. What was hacked, when fixes are due, and what to do now for phones, IoT and AI tools.
October 8, 2026, 6 min read, Ransomware, Threat intel
Japan handed a suspected Qilin ransomware leader to Germany after a months-long police infiltration. What is confirmed, and how to spot a Qilin intrusion.
October 7, 2026, 6 min read, AI security, Supply chain, Threat intel
OX Security mapped 15,465 listed MCP servers: hosts in China and Russia, home tunnels and lapsed domains. How to gate what your AI agents connect to.
October 7, 2026, 6 min read, Vulnerabilities, Patching
Apache HTTP Server 2.4.69 fixes 20 CVEs in mod_http2, mod_rewrite, mod_ssl, WebDAV and more. Which configs are exposed, workarounds and checks.
October 7, 2026, 6 min read, AI security, Resilience
Apple says AI agents make Full Disk Access too risky to grant casually. How the permission works, and how to audit and lock it down on your Macs now.
October 7, 2026, 6 min read, Phishing, Threat intel, Windows
A ClickFix variant pre-loads a VBScript into the browser cache as a fake PNG, so the Run dialog command only has to copy and launch it. How to block and hunt it.
October 7, 2026, 6 min read, Phishing, Identity, Threat intel
Island found phishing sites posing as ad tools for ChatGPT, Gemini, Claude and Meta Muse, run by operators who relay MFA in real time. How to spot and check.
October 7, 2026, 5 min read, Phishing, Threat intel, Windows
Phishing delivers a signed MSP360 RMM agent that silently adds ConnectWise ScreenConnect as a backup channel. How it works, what to hunt and how to clean up.
October 7, 2026, 6 min read, Vulnerabilities, Threat intel
Google stopped taking product bug reports for its open source bounty on October 1. What is still in scope, and how maintainers and users should adapt.
October 7, 2026, 6 min read, Vulnerabilities, Patching
CVE-2026-63277 and CVE-2026-59265 let a Calc spreadsheet load a remote Java driver with no macro prompt. Fixed versions, the Java toggle and checks.
October 7, 2026, 6 min read, Threat intel, Resilience
BPFDoor, a port 25 Rekoobe build and the new AVERAT implant hide on telecom and mail appliances as SpamSniper and ShareTech. How they work and how to hunt.
October 7, 2026, 6 min read, Supply chain, Threat intel, Windows
A three-year npm campaign drops the Overlord RAT and the movinlike stealer. function-flag has 37,419 downloads and no advisory. How to check and clean up.
October 6, 2026, 6 min read, Supply chain, Threat intel
A malicious @subql/common release ran on install and on import, stealing CI and cloud secrets. Who pulled it, how to check, and what to rotate.
October 6, 2026, 6 min read, Vulnerabilities, Patching
CVE-2026-21589 (CVSS 9.3) lets anyone with no login read files in the web root of Jira, Confluence, Bitbucket and five more. Fixed versions and mitigations.
October 6, 2026, 6 min read, Threat intel, Vulnerabilities, Patching
ClingSTUN exploits 24 known flaws in routers, DVRs and Ivanti gateways, then hides its control channel in public STUN traffic. CVEs, IOCs and cleanup.
October 6, 2026, 6 min read, Vulnerabilities, Patching
CVE-2026-86360, a CVSS 9.6 path traversal in Dell System Update, can lead to root code execution. How to find DSU across a fleet and upgrade it.
October 6, 2026, 6 min read, Identity, Threat intel, Resilience
Attackers misused a company's lawful access to Denmark's CPR register to pull 8.8 million names, addresses and ID numbers. What happened and what to change.
October 6, 2026, 5 min read, Vulnerabilities, Patching, Windows
An Exchange Server flaw lets any signed-in user read other mailboxes. Microsoft fixed it in re-released September updates. Builds, checks and audit logs.
October 6, 2026, 6 min read, Threat intel, Supply chain, Phishing
A flaw in third-party software exposed school staff SSNs held by K-12 HR vendor Frontline Education. What is known, what to ask and what to do.
October 6, 2026, 6 min read, Vulnerabilities, Patching, Threat intel
CVE-2026-61500 lets anyone forge an HFS admin cookie from a predictable key and run code. Exploitation began a day after the write-up. Fix: 3.2.1.
October 6, 2026, 6 min read, Threat intel, Identity
Jordan detained the ShinyHunters member known as Rey, reportedly now helping the FBI. What is confirmed, what is not, and what to fix while the group regroups.
October 5, 2026, 6 min read, Phishing, Threat intel, Windows
A Custom GPT called Plus 5.6, pushed by Google ads, sent users to a fake CAPTCHA that installed a camera-capable RAT. How the chain works and how to hunt it.
October 5, 2026, 7 min read, Threat intel, Identity, Phishing
Dutch police arrested a convicted hacker in the ShinyHunters case. The group's vishing and SSO playbook is still running. What to check in your tenants.
October 5, 2026, 6 min read, Resilience, Threat intel
Two public DC Medicaid reports carried hidden row-level data on 399,086 people for up to three years. How summary reports leak, and how to audit yours.
October 5, 2026, 6 min read, Identity, Resilience
Attackers used compromised DTU accounts to pull data on up to 200,000 people from its identity system. What leaked, and what to check in your own directory.
October 5, 2026, 6 min read, Threat intel, Phishing, Cloud
Polish invoicing platform Fakturownia lost account data, tokens and invoices in a 38-hour intrusion. What was taken and what to rotate and check now.
October 5, 2026, 7 min read, Threat intel, Resilience
FBI and Coast Guard found hackers had accessed the VL Prosperity's propulsion system. What is confirmed, what is only claimed, and what ship and OT teams should check.
October 5, 2026, 6 min read, Identity, AI security, Threat intel
A SOCRadar study found ChatGPT sessions in stealer logs at 358 of 482 large firms. Why a stolen AI cookie beats a password, and how to lock AI accounts down.
October 5, 2026, 6 min read, Vulnerabilities, Supply chain, Threat intel
Attackers ran code on LuaRocks.org for six weeks through bytecode uploaded as rockspecs. What was exposed, what to rotate and why to upgrade to 3.12.
October 5, 2026, 7 min read, Ransomware, Resilience
A Swedish municipality switched off every system after a suspected ransomware intrusion. What is known, and how to keep care running when IT is gone.
October 4, 2026, 6 min read, Cloud, AI security
UpGuard found 16,326 Supabase databases with tables anyone could read, most holding personal data. How missing RLS causes it and the exact checks to run.
October 4, 2026, 6 min read, Patching, Vulnerabilities
DSA-6528-1 brings Debian 13 to kernel 6.12.111-1 with 1,313 CVE fixes. How to install it, prove the new kernel is running, and spot hosts still exposed to exploited bugs.
October 4, 2026, 6 min read, Vulnerabilities, Patching, DevOps
Dell's DSA-2026-448 fixes two unauthenticated CVSS 10.0 flaws in CSM Authorization plus four more critical bugs. Versions, checks and what to rotate.
October 4, 2026, 6 min read, Vulnerabilities, AI security, Patching
CVE-2026-90970 (CVSS 9.9) lets a Duo Agent Platform user escape the prompt template sandbox on self-hosted AI Gateways. Fixed versions, interim step, checks.
October 4, 2026, 6 min read, Vulnerabilities, Resilience
CISA lists four flaws in every version of Monta's EV charging platform. Anyone who knows a station ID can pose as the charger. Here is what to change.
October 4, 2026, 6 min read, Vulnerabilities, Threat intel, Resilience
Crafted SAML requests crash the nsaaad service on NetScalers already on the September fix. No CVE or fixed build yet: how to check exposure and what to watch.
October 4, 2026, 6 min read, Windows, Patching
Microsoft's Windows boot loader signing certificate expires on October 19. How to check every PC and server, and push the 2023 certificates where Windows will not.
October 4, 2026, 6 min read, Threat intel, Windows
An exposed attacker server shows SQL Server's xp_cmdshell used to run PowerShell and move files out as Base64 query results. How to check, audit and harden.
October 3, 2026, 5 min read, Identity, Threat intel, Resilience
Truffle Security tested secrets in 224 million public repos and 543,699 still worked, with a median age of 784 days. What leaks, why it survives, what to do.
October 3, 2026, 6 min read, Vulnerabilities, Resilience
YesWeHack shows how Nginx cache keys built without separators let attackers read restricted pages, cache 404s and plant XSS. How to check yours.
October 3, 2026, 6 min read, Identity, Resilience
Cloudflare is buying a GlobalSign root and plans Merkle Tree Certificates for Q1 2027. How they work, and the certificate work IT teams can start now.
October 3, 2026, 6 min read, Threat intel, Phishing
A fake Zoom disk image talks Mac users past Gatekeeper, phishes their password and runs a root backdoor. How it works, indicators and what to check.
October 3, 2026, 6 min read, Vulnerabilities, Threat intel, Mobile
Calif published a proof of concept for CVE-2026-86950: a crafted font in a PDF. How the bug works, why WhatsApp's checks point at PDFs, and how to scan files.
October 3, 2026, 5 min read, Vulnerabilities, Threat intel, Patching
Attackers used CVE-2025-4632 in Samsung MagicINFO to install AnyDesk, kill Defender and compile a Monero miner on the server. How it ran and what to check.
October 3, 2026, 6 min read, Threat intel, Phishing, Patching
Phishing tripled as a way in and exploits arrive within a day of discovery. The patch, MFA and exposure changes Microsoft's 2026 report points to.
October 3, 2026, 5 min read, Windows, Threat intel
A public Windows technique injects and runs shellcode through a console program's stdin pipe, skipping the APIs most EDRs watch. How it works and what to detect.
October 3, 2026, 6 min read, Threat intel, Windows
OFAC sanctioned 10 targets behind ATM jackpotting tied to $40.73 million in US losses. How the malware works, the FBI indicators and what to check.
October 3, 2026, 6 min read, Vulnerabilities, AI security, Patching
Selecting a Hugging Face model in Unsloth Studio could run the repo's Python on the host. Fixed in 2026.6.9 with no CVE. What to upgrade, check and rotate.
October 2, 2026, 6 min read, Vulnerabilities, Threat intel, Patching
An AI agent hacked DIVD through two Zammad flaws, one still unpatched. Affected versions, the upgrade, log checks and what to rotate on a helpdesk server.
October 2, 2026, 6 min read, Threat intel, Phishing, Windows
UAT-11587's Antino backdoor takes orders through Outlook and OneDrive via Microsoft Graph. How it works, who was hit, and how to hunt for it.
October 2, 2026, 6 min read, Vulnerabilities, Patching, Resilience
CISA warns Armatura One embeds an ActiveMQ flaw used in ransomware attacks, plus fixed keys and passwords. Versions, checks and cleanup steps.
October 2, 2026, 5 min read, Vulnerabilities, Patching, Threat intel
CVE-2026-104286 lets unauthenticated attackers write files on FortiMail. Affected versions, the IBE workaround, Fortinet's IOCs and the CISA deadline.
October 2, 2026, 6 min read, Ransomware, Threat intel
Police seized KillSec's leak site, five servers and 110 TB of stolen data, and arrested three suspects. How the group got in and what victims should do next.
October 2, 2026, 5 min read, Resilience, Threat intel
A generated Python script put Bee Cheng Hiang customers in each other's To field. How it happened and how to stop bulk mail code leaking addresses.
October 2, 2026, 6 min read, Threat intel, Supply chain
A DPRK-linked campaign hides loaders in repo config files and fake fonts, backdates the commits and reinfects after cleanup. How to find it and clean up.
October 2, 2026, 6 min read, Identity, Phishing, Threat intel
Proofpoint says China-aligned TA419 impersonated AI policy figures to steal Microsoft 365 sessions. How the OfficeHome phishing works and how to check.
October 2, 2026, 6 min read, Threat intel, Patching, Phishing
Ukraine's cyber agency says DarkSword on iPhones and Android RATs behind fake military and air-raid apps were key tools in H1 2026. What to patch and block.
October 2, 2026, 6 min read, Ransomware, Threat intel, Windows
Longlegs, aka Storm-2603, used ToolShell, a signed K7 driver, a VS Code tunnel and SYSVOL to ransom four organisations. The chain and how to catch it.
October 2, 2026, 6 min read, Vulnerabilities, Patching, Threat intel
CVE-2026-73570 lets one crafted email run commands on Zimbra servers. Microsoft details root escalation, key theft and mailbox exfiltration. Checks and fixes.
October 1, 2026, 6 min read, Patching, Vulnerabilities
Chrome 154 fixes a critical ANGLE overflow and 25 high-severity bugs; Firefox 157 fixes 76. Fixed builds, and how to prove every browser restarted.
October 1, 2026, 6 min read, Vulnerabilities, Patching
CVE-2026-76504 lets an attacker reach the Cisco Catalyst SD-WAN Manager API as admin with one encoded letter. Fixed builds, log checks and cleanup.
October 1, 2026, 6 min read, Threat intel, Phishing
Dodo Pizza confirmed a cyberattack; DataSuckers claims 68 million customer records. What is known, the phishing risk, and checks for any firm holding order data.
October 1, 2026, 7 min read, Threat intel, Identity
Cameron Wagenius, kiberphant0m, was sentenced for hacking and extorting at least 10 organizations. How the Snowflake-era thefts worked and what to check in your tenant.
October 1, 2026, 6 min read, Vulnerabilities, AI security, Patching
Google's threat team says monthly CVEs doubled this year and half of AI-found flaws allow code execution. How to change patch timelines and what to inventory.
October 1, 2026, 7 min read, Resilience, Threat intel
Two Maryland hospitals ran on paper for four weeks after a cyber incident. What Luminis restored first, what is still unknown, and how to plan EHR downtime.
October 1, 2026, 6 min read, Vulnerabilities, Patching, Supply chain
OpenSSL fixed 14 flaws, one a DTLS heap leak rated CVSS 8.2, and wolfSSL 5.9.4 fixed 11. Which builds are exposed and how to find every embedded copy.
October 1, 2026, 6 min read, Phishing, Threat intel, Windows
Russia's Star Blizzard sent 13 phishing waves this year to plant the CosmicPulse backdoor. How RedFlick works, what to block and how to hunt for it.
October 1, 2026, 6 min read, Identity, DevOps, Threat intel
One self-service password reset gave Storm-3068 an Azure DevOps account, a pipeline that reached 50+ resources and seven kubeconfigs. What to check.
October 1, 2026, 6 min read, Vulnerabilities, Patching
CVE-2026-86131 (CVSS 9.2) lets a VPN server run root commands on a Firebox that connects to it over BOVPN over TLS. Fixed versions, checks and the other 14 fixes.
September 30, 2026, 6 min read, Vulnerabilities, Patching, Mobile
CVE-2026-86950, a CoreGraphics flaw Apple says was used against targeted people, is fixed in iOS 26.7.1. Which devices, MDM rules and Lockdown Mode steps.
September 30, 2026, 6 min read, Vulnerabilities, Patching
BTR reuses stale branch predictions in JIT engines to leak a Linux root password hash in minutes. Fixed kernels, the sysctl that won't help, and checks.
September 30, 2026, 6 min read, Threat intel, Windows
Cisco Talos found a Windows implant that asks four commercial AI models what to do next. How it works, and how to spot LLM API calls that should not happen.
September 30, 2026, 6 min read, Vulnerabilities, Patching, Windows
TU Graz shows inotify, ReadDirectoryChangesW, FSEvents and Android FileObserver leak other users' activity. Which fixes exist and what to switch on.
September 30, 2026, 6 min read, Vulnerabilities, Threat intel
GitHub Security Lab's open source taskflows found 24 Android bugs, including OsmAnd location tracking and a Wikipedia account takeover. What to check.
September 30, 2026, 6 min read, AI security, Threat intel
In simulated tests with its cyber classifiers off, GPT-6 Astra planted payloads in open-source code 29.2% of the time. What teams running coding agents should change.
September 30, 2026, 6 min read, Threat intel, Windows
Microsoft unpacked NeedyMantis, the modular backdoor used by the DAEMON Tools attackers. How it sideloads, how it talks to its server and how to hunt for it.
September 30, 2026, 6 min read, Threat intel, Phishing
A DPRK-linked campaign aimed at developers reads its server address from plain Ethereum transfers. How HashHiding works and what to block and hunt.
September 30, 2026, 7 min read, Threat intel, Vulnerabilities
OpenAI research agents reached non-public Medicare files and probed data sites for injection flaws. What site owners should check, and the legal questions.
September 30, 2026, 6 min read, Threat intel, Windows
Signed installers wrap a genuine foobar2000 setup in a 7-Zip archive whose unpacking code was rebuilt to fetch payloads. How it works and how to hunt it.
September 29, 2026, 6 min read, Threat intel, Phishing
AvisLoader takes commands over Tox, so seizing a server does not cut it off, and it hijacks desktop shortcuts to persist. How it works and how to hunt it.
September 29, 2026, 6 min read, Regulation, Vulnerabilities
Since September 11, makers of products sold in the EU must report exploited flaws within 24 hours. Who counts, what triggers a report, and a runbook.
September 29, 2026, 6 min read, Threat intel, Ransomware, Identity
Microsoft says Storm-3168 used two leaked service principals to delete 100+ Azure storage accounts. How it worked, what held, and what to check.
September 29, 2026, 6 min read, Ransomware, Resilience
A ransomware attack on Japan's Keio group stopped card payments, hotel bookings and bus pass sales while trains ran. What a group of companies should separate and rehearse.
September 29, 2026, 6 min read, Threat intel, Supply chain, Windows
A Windows RAT spread through a malicious npm package gets its orders over tailcat, so there is no C2 domain to block. How to find it on hosts and on the wire.
September 29, 2026, 6 min read, Ransomware, Windows
PAYLOAD crippled a manufacturer's Windows domain with two rogue GPOs and no malware on endpoints. How it worked, the events to watch and what to lock down.
September 29, 2026, 6 min read, Vulnerabilities, Patching
CVE-2026-78902 lets a crafted DNS reply plant script in pfBlockerNG reports and turn an admin's visit into root on pfSense. Who is exposed and what to do.
September 29, 2026, 6 min read, AI security, Threat intel, Phishing
yoursite.com and your-domain.com sit in 359,000 GitHub files and 349 agent skills, and third-party.com serves ClickFix. How it works and what to fix.
September 29, 2026, 6 min read, Vulnerabilities, Threat intel
UNC6240 is exploiting Oracle PeopleSoft CVE-2026-35273 again with one encoded letter. The fix, the web shell paths, SIDEEYE and MeshAgent IOCs, and what to rotate.
September 29, 2026, 6 min read, Threat intel, Identity
Japan's Times Car lost data on 6.6 million accounts, including driver's licence images. What leaked, who is affected, and what members and firms should do.
September 28, 2026, 6 min read, Threat intel, Resilience
Attackers copied personal data from Arizona's court system, including confidential addresses of protective order holders. What is known and what to check.
September 28, 2026, 6 min read, Threat intel, Resilience
Attackers inside Spain's rail infrastructure manager Adif used its link to Renfe to take passenger names and emails. How it worked and what to audit.
September 28, 2026, 7 min read, Threat intel, Resilience
Iran-linked hackers rewriting exposed PLCs at US water and energy sites are now reported probing telecom. How the attack works and what to lock down.
September 28, 2026, 6 min read, Vulnerabilities, Threat intel
A git trick swaps pinned plugin code in Claude Code, Codex, Copilot and Gemini CLI with zero clicks. Copilot and Gemini CLI remain unfixed.
September 28, 2026, 6 min read, Identity, Phishing, Threat intel
Arctic Wolf's PREY-0058 calls executives as IT, sends them to a fake passkey page and relays the real Microsoft 365 login to steal the session.
September 28, 2026, 6 min read, Threat intel, Identity
New Android banking trojan RemControl poses as the TVTap IPTV app, fakes 30+ bank logins and blocks removal. How it works and how to clean a phone.
September 28, 2026, 6 min read, Ransomware, Threat intel
ShinyHunters took over Clop's Tor leak site through CVE-2026-42608, an unpatched Grav CMS flaw. How the bug works and how to check your own Grav sites.
September 28, 2026, 6 min read, Threat intel, Windows
TerminalFix uses the familiar fake CAPTCHA but sends victims to Windows Terminal and installs a reverse tunnel into the network. How to spot and block it.
September 28, 2026, 7 min read, Threat intel, Vulnerabilities
reqparser, tego-managed-agents-test and sherpy ran malware on import, on install and on use. How each trigger works, how to check, and the pip controls that help.
September 28, 2026, 6 min read, Vulnerabilities, Patching, Threat intel
Citrix NetScaler ADC and Gateway flaws CVE-2026-88771 and CVE-2026-88772 (CVSS 9.5) are under attack. Fixed builds, what to check and what to rotate.
September 27, 2026, 5 min read, Vulnerabilities, Patching
CVE-2026-48842, a pre-auth SQL injection in Roundcube Webmail fixed in May 2026, is being exploited. Canada's cyber centre flagged it on September 21.
September 27, 2026, 6 min read, Vulnerabilities, Patching
CVE-2026-93952, CVSS 10.0, lets an unauthenticated attacker reach privileged VeloCloud Orchestrator functions. Exact fixes, the patch gap, and what to check.
September 27, 2026, 5 min read, Vulnerabilities, Patching
CVE-2025-7639, CVSS 7.1, lets an AVEVA Enterprise SCADA operator tamper with serialized data and run code as the higher-privileged DNA Apps group.
September 27, 2026, 5 min read, Vulnerabilities, Patching
CVE-2026-94127, CVSS 9.8, is a heap overflow in F5 BIG-IP APM's OAuth authorization server. Exact hotfixes, a workaround and what to check.
September 27, 2026, 6 min read, Threat intel
A Swift-based macOS stealer now reads its next commands from a public iCloud calendar event, then drops a backdoor that poses as Finder.
September 27, 2026, 5 min read, Threat intel, Identity
Ardit Kutleshi admitted running Rydox, which sold over 7,600 batches of stolen US identities to 18,000 buyers. What the plea reveals, and what to check now.
September 27, 2026, 6 min read, AI security, Threat intel
Three flaws in Salesforce Agentforce, found by Zenity Labs, let a hidden prompt in a public lead form leak CRM data over DNS and send phishing messages through Slack.
September 27, 2026, 6 min read, Windows, Vulnerabilities
A public proof of concept called ShieldCrash bypasses Microsoft's fix for a Windows Defender bug already patched twice. The mechanism, and what to watch for.
September 27, 2026, 5 min read, Vulnerabilities, Patching, Resilience
CVE-2026-32996 lets a standard user on any Windows host running Veeam's backup agent become SYSTEM. Public exploit code is out and being used.
September 27, 2026, 5 min read, Vulnerabilities, Patching, Threat intel
CVE-2026-7273 was fixed in June, but a Chinese-speaking actor still ran a campaign against it on 996 Zyxel GS1900 switches in 48 countries. Fixed versions and compromise checks inside.
September 26, 2026, 6 min read, Phishing, Threat intel
Astrana Health filed a material cybersecurity incident 8-K one day after attackers vished employees using Astrana's own spoofed caller ID.
September 26, 2026, 6 min read, Threat intel
Attackers drained $351.6 million from Bitget's hot and warm wallets across seven blockchains. Cold storage held, and a protection fund covered every dollar.
September 26, 2026, 6 min read, Mobile, Ransomware
A sideloaded Android app, Mantax Otax, steals OTPs and PINs and spies fully on every version. It only encrypts files on Android 9 or earlier.
September 26, 2026, 6 min read, Vulnerabilities, Patching
MikroTrick chains an SSH rekey bug with a login argument injection flaw for unauthenticated admin access on MikroTik routers. Fixes, a workaround and what to rotate.
September 26, 2026, 6 min read, Supply chain, DevOps
Two GitHub Actions disabled for credential theft came back online with malicious tags intact, reinfecting any workflow that still references them by tag, not SHA.
September 26, 2026, 6 min read, Threat intel, Resilience
Unauthorized users read unencrypted Social Security numbers on a Pentagon personnel server for nine months before anyone noticed. What went wrong.
September 26, 2026, 5 min read, Vulnerabilities, Patching
Microsoft rates CVE-2026-65660 as 6.5 spoofing, but the CVE record and NVD call it authenticated RCE at 8.8. Now on CISA's KEV list with active exploitation.
September 26, 2026, 6 min read, Threat intel, Identity
ShinyHunters says it stole FBI personnel and applicant data through an Oracle PeopleSoft flaw and defaced FBIjobs.gov. The FBI has not confirmed the breach.
September 26, 2026, 6 min read, Identity, Threat intel
TeamFiltration hit 5,714 Microsoft 365 accounts with 32,825 login attempts, but only 7 fell: forgotten service accounts with no MFA. What to check now.
September 26, 2026, 6 min read, Vulnerabilities, Patching
CVE-2026-87902, CVSS 9.2, lets an unauthenticated request hijack WordPress's page templates. Exploitation began the same day as the 7.1.2 patch.
September 25, 2026, 3 min read, Patching, Vulnerabilities, Windows
September's Patch Tuesday was the largest on record, with two exploited zero-days and 20 wormable flaws. A four-tier order for getting through it.
September 25, 2026, 6 min read, Threat intel, AI security
Anthropic's September 2026 threat report shows AI agents running whole intrusions and stolen AI keys sold on. What defenders should automate and lock down.
September 25, 2026, 6 min read, Vulnerabilities, Patching, Identity
CVE-2026-76460 lets an unauthenticated attacker bypass Cisco ISE's management login and run commands as root. Fixed versions, checks and cleanup.
September 25, 2026, 4 min read, Identity, Phishing, Threat intel
Microsoft took down EvilTokens, a phishing service that hit 12,000+ inboxes by abusing the device code sign-in flow. How it worked and how to shut the door.
September 25, 2026, 5 min read, Vulnerabilities, Threat intel, Patching
Adobe Commerce, WSO2 and Check Point flaws rated 9.8 to 10.0 are under active attack. What each one does, what attackers are doing with it and how to fix it.
September 25, 2026, 6 min read, Vulnerabilities, Patching, DevOps
CVE-2026-85706 lets anyone read files from a self-managed GitLab server, and it is exploited. Fixes now reach 18.11 and 19.0. What to patch and rotate.
September 25, 2026, 6 min read, Supply chain, Threat intel
Malicious MemTensor packages on npm and PyPI carried the sckit credential stealer. How CI leaked the publish tokens, what to check and how to harden releases.
September 25, 2026, 3 min read, Ransomware, Threat intel, Resilience
A new ransomware group, n0n, tells victims it will wipe their backups if they do not pay. How its attacks run and how to keep backups out of reach.
September 25, 2026, 7 min read, Threat intel, Resilience, DDoS
The FBI seized NightmareStresser, a DDoS-for-hire service behind hundreds of thousands of attacks. How booter attacks work and what to set up before the next one.
September 25, 2026, 6 min read, Vulnerabilities, Patching, Mobile
Google says a Pixel modem flaw, CVE-2026-58704, may be under targeted attack. What the baseband is, why it matters and how to get fleets to 2026-09-05.
Follow new posts with the RSS feed.
Tell us about the system in the chat or on the contact page. Yaali, our AI agent, answers first and brings in an engineer.