Threat Intel

Threat actor tradecraft and emerging techniques, translated into decisions for defenders.

An ultra-realistic photograph of an enterprise IT systems deployment lab at dusk with dual widescreen monitors displaying abstract software package distribution flowcharts and progress bars.

Threat Intel6 Nov 2026

Microsoft Store patch for Paint RCE CVE-2026-83844 bypasses Windows Update

Microsoft releases build 11.2609.401.0 fixing Paint RCE CVE-2026-83844, but Windows Update will not deliver it. Decoupled Store servicing, per-user AppX package isolation, and a 24-day catalog delay leave enterprise fleets unpatched.

An ultra-realistic photograph inside a threat intelligence research lab showing a compact Linux server appliance with opened panel revealing circuit boards beside a USB security key and network cables against dark server racks.

Threat Intel6 Nov 2026

OpenSSH sshole flaw exploited in the wild within nine hours as honeypot yields root access

OpenSSH sshole vulnerability (CVE-2026-123158) exploited in the wild within nine hours of disclosure. Honeypot telemetry confirms root compromises via 257-byte payloads as scanners execute automated discovery commands.

An ultra-realistic photograph inside an enterprise telecom data facility showing an open Ethernet switch chassis with circuit boards and SFP+ cages beside a coiled blue console cable and stacked network switches in an equipment rack.

Threat Intel6 Nov 2026

D-Link warns of multiple unpatched zero-days in enterprise DGS-3130 stackable managed switches

D-Link warns of multiple unpatched zero-days across DGS-3130 stackable switches affecting discovery protocol and firmware architecture. Allows unauthenticated credential theft, SNMP leakage, and remote factory resets.

An editorial architectural photograph of an executive government telecommunications routing facility and secure data center terminal.

Threat Intel6 Nov 2026

Layer3 Intel detects 28 residential proxy networks exiting from White House AS2650

Layer3 Intel discloses 236 residential proxy exits originating from the White House network AS2650 across 26 of 30 days. Technical analysis of Infatica SDK bundling, diurnal evening clustering, attribution spoofing, and lateral movement risks.

An editorial architectural photograph of an enterprise banking transaction clearing operations room and automated payment processing mainframe bank.

Threat Intel6 Nov 2026

CERT-In warns of CRAFTY FALCON AI financial attacks siphoning payment APIs

CERT-In issues Critical Advisory CIAD-2026-0058 detailing CRAFTY FALCON, an AI-assisted campaign chaining ARTEX, PentAGI, Cairn, and CyberStrikeAI to compromise non-production environments and manipulate financial payment APIs.

An editorial architectural photograph of an enterprise Linux web hosting data center and server rack infrastructure with a rackmount chassis on slide rails.

Threat Intel5 Nov 2026

Threat actors backdoor Linux servers with trojanized Control Web Panel binary

Threat actors deploy CWPdoor, a passive Linux backdoor hidden inside Control Web Panel web servers across 340,000 exposed systems. Technical analysis of RSA-signed HTTP triggers, Unix socket IPC, in-memory log suppression, and Brazil telemetry.

An editorial architectural photograph of an industrial cold-storage machinery room with frosted coolant pipes, heavy mechanical valves, and a cold vault door standing ajar.

Threat Intel5 Nov 2026

CISA and FBI warn of cyberattacks tampering with industrial cooling systems

CISA and the FBI issue an urgent advisory on industrial refrigeration cyberattacks. Analysis of 11-nation European retail spoilage, French blood bank tampering, DoD commissary investigations, and unpatched PLC defrost manipulation.

An industrial master key cabinet in an archival workshop with rows of heavy vintage brass keys hanging against dark wooden boards and disassembled lock cylinders on an oak workbench.

Threat Intel5 Nov 2026

OpenSSH flaw lets attackers log into password-disabled accounts on musl Linux with a 257-character password

An architectural collision between OpenSSH, musl libc, and 1980s BSD shadow conventions allows attackers to log into locked accounts with a 257-byte password. The 46-year timeline, agent swarm discovery, cloud exposure, and OpenSSH's warning on AI bug discovery.

An oak drafting table at night with an expansive architectural map unrolled across it, extending far past the wooden edge and jutting into empty air under an amber banker's lamp. In the background, tall floor-to-ceiling map drawer cabinets. The headline reads: GhostMap: the Android flaw that crashes phones with zero permissions, 1,995X.

Threat Intel5 Nov 2026

GhostMap: the Android flaw that needs no code to crash a phone, and a vendor that closed it as out of scope

An APK requiring zero permissions and containing zero code plunges Android into an infinite crash loop. What Bitdefender found in wild banking samples, the ZIP parser gap in libandroidfw, the SIGBUS fault in system_server, Google's response, and what defenders must know.

A 1950s manual telephone switchboard in a quiet exchange room at night. Rows of brass jacks fill a walnut cabinet and most cords sit neatly in place, but one dark red cord runs taut across the board to the wrong jack, under a single lit red lamp. A brass desk lamp glows amber; a tall window shows deep blue night and a distant radio mast. The headline reads: Binarly: the Zyxel patch CISA named did not stop the exploit, 10 of 10.

Threat Intel4 Nov 2026

Zyxel GS1900: the patch CISA pointed to did not stop the exploit used on 996 switches, Binarly says

Zyxel's own November table lists every June fixed release as affected by CVE-2026-107441. What Zyxel, Binarly, GreyNoise, the CVE records and CISA's KEV catalogue say, the dated gaps, what nobody has established, and a ranked checklist for GS1900 owners.

The inside of an old railway signal box at night. A row of tall red signal levers stands in an iron frame, and one lever, painted teal, is pulled back towards the camera. Behind it a window shows a rail junction where one set of points sends the track away, with a single amber signal lamp. A lit track diagram of coloured lines hangs above. The headline, a stat of 121 days and a source line are drawn over the left side.

Threat Intel4 Nov 2026

ESET says DNS hijacking turned a Sogou Input Method icon request into a DarkVigil implant install

What ESET's report establishes about the SlippyNunchucks operation against Sogou Input Method users: the icon request, the forged DNS answer, the two files, the fix in 16.10, the China-aligned label, what is not stated, indicators and a ranked checklist.

A decommissioned airport control tower cab at dusk. Most desks are covered in pale dust sheets; one old console is uncovered and its round green radar screen still glows, with a forgotten headset, a white mug and coffee rings beside it. Through the slanted windows, long rows of blue and white runway lights stretch away under a purple sky. The headline reads: SonicWall says two GMS flaws will never be fixed, CVSS 9.1.

Threat Intel4 Nov 2026

SonicWall says two flaws in end of life GMS will never be fixed, one an unauthenticated file read rated 9.1

What SonicWall's advisory and the CVE records state and leave out: no fix, no workaround, no exploitation recorded on 3 November, a score whose critical label rests on availability, and a checklist for anyone still running GMS.

The empty bar of a village pub at dusk. On a dark wooden counter three smartphones lie screen up, two in grey cases and one in olive, each beside a half full glass of beer, with a row of brass beer taps behind. A large gilt framed mirror reflects the bar with small differences, a different lamp and a tap handle missing. The headline, a stat of 3 routes and a source line are drawn over the left side.

Threat Intel4 Nov 2026

Sekoia says APT29 watering holes used patched iOS and Android flaws, one route via a compromised tracker

What Sekoia's post of 4 November 2026 says about three routes, one profiling script and three exploit chains, the dates and the attribution, where BleepingComputer differs, a fix gap on iOS 16.7, the indicators it prints, and a ranked checklist.

A phone repair bench at night under a ring light magnifier lamp. One handset lies open on a dark mat, its green circuit board exposed with a single red sticky flag, and a tray behind it holds rows of identical dark handsets, most with a green flag. A steaming mug, a roll of screwdrivers and a pegboard of blank tags sit around it, with wet blue street light beyond the window. The calm left side carries the headline: Google's Android bulletin, 216 flaws, 23 critical, in two patch levels.

Threat Intel4 Nov 2026

Google's Android bulletin lists 216 flaws, 23 critical, in two patch levels, and names no exploitation

What Google's bulletin states and leaves out: the two patch levels, 23 Critical rows counted from its tables, one Framework flaw rated most severe, no word on exploitation, and a checklist for what the date string on a phone does and does not tell you.

An old post sorting office at dawn. A tall wall of dark wooden pigeonholes, almost all holding a plain cream envelope and exactly seven holding one sealed with a bright red wax blob, stands at the right beside a brass library ladder. At the left a sorting table with a rubber stamp, an ink pad and a canvas sack sits under an arched window with a cold blue dawn and bare trees, lit by a warm brass desk lamp. The headline and a 7 CRITICAL stat are drawn over the left side.

Threat Intel4 Nov 2026

Google lists all 213 Chrome 157 fixes and 7 Critical, but prints a dollar amount on only 9

The 213 lines counted by severity, credit and bounty field, SecurityWeek's figures checked against Google's post, what the post does not state, and a ranked checklist for updating.

A water treatment works control room at dawn. A large cork noticeboard on the wall has three coloured threads, red, amber and green, pinned from one point and fanning out in three directions, beside a brass wall barometer with its needle at the midpoint. An old grey monitor with flat tank shapes, a small red lamp and a steaming tin mug sit on a desk by a window with a distant water tower. The headline and an 80 to 90 per cent stat are drawn over the left side.

Threat Intel3 Nov 2026

NCSC says AI-powered malware in a ransomware attack on UK CNI is 'highly likely' by 2028, a range of 80 to 90%

What the NCSC assessment, news release and annual review pages state about AI and ransomware on UK CNI: the yardstick ranges, all four key judgements, three scenarios that are not predictions, what is not stated, and a ranked checklist.

A school staff room at night with a cold teal window and a distant lit corridor. On a worn wooden desk stand a brass and walnut metronome with its pendulum caught mid swing and an open grey laptop whose screen shows rows of blank teal bars of slightly different lengths, beside a stack of plain exercise books and a brass hand bell. An old beige tower PC sits under the desk with a small amber light. The headline, a stat of 40 seconds and a source line are drawn over the left side.

Threat Intel3 Nov 2026

Bitdefender calls a 3AM attack on a UK school estate hybrid: model like commands, a human not ruled out

What Bitdefender's post on a 3AM attack against a UK school estate establishes about the three claims inside AI ransomware, the retry timing, the 10 to 19 September timeline, the conventional parts, the detection advice and the indicators it prints, and what it leaves unsaid.

A computer lab at golden hour, no people. In the foreground a tall grey tower computer on a teacher's desk, a black cable running up the wall to a white ceiling wireless unit with a small green light. Beside it a lit old monitor showing a repeating chevron pattern, with rows of dim identical monitors on benches, a palm tree window and a wall clock behind. The headline, a headline stat of 3 to 4 days and a source line are drawn over the left side.

Threat Intel3 Nov 2026

Kaspersky says an LLM on the attacker's server chose the commands; agent to domain admin took 3 to 4 days

What Kaspersky's Securelist post of 2 November 2026 says about CyberStrikeAI, the one incident's durations, the evidence for a model, the attribution clues, the indicators it prints, what it leaves out, and a ranked checklist.

A dim municipal office at dusk. A beige desktop computer with a bulky monitor shows an empty spreadsheet grid with one unlocked padlock shape. Beside it a paper shredder is mid shred, strips of paper falling, with a ring binder, a rubber stamp and a green desk lamp on the desk and a window with distant lit apartment windows. The headline, a headline stat of 25 percent plus 25 percent and a source line are drawn over the left side.

Threat Intel3 Nov 2026

ESET says Gorbag harvests Ukrainian justice bodies and city councils in one pass, then deletes itself

What ESET's blog post and Virus Bulletin white paper establish about Gorbag, the chain from a macro spreadsheet to a WinRAR archive, the target split, the self removal, the initial access broker hypothesis, what is not stated, and a ranked checklist.

An open electrical control cabinet at night in a plant, lit sulphur yellow and cyan. A compact grey fanless gateway sits on a steel DIN rail with a row of small port lights and two network cables, a tiny red beacon is lit above it, and a card taped inside the open door shows two small rectangles joined by one thick line. A spool of orange cable lies in the foreground. The headline and an 80 days stat are drawn over the calm left side.

Threat Intel3 Nov 2026

VulnCheck says its canary caught CVE-2026-58115, a CVSS 10 Siemens flaw, exploited 80 days after the advisory

What Siemens, the CVE record, VulnCheck and the Node-RED documentation establish about CVE-2026-58115: one Siemens device on the record, a wider class in the post, what a canary sighting shows, and a ranked checklist.

The cab of a utility van at teal dusk beside a substation fence. A large rugged tablet on the dashboard shows an abstract padlock drawn half open above rows of slider shapes, a glowing signal arc crosses the rain streaked windscreen towards a lit equipment cabinet behind the fence, and a closed steel toolbox sits on the passenger seat. The headline and a stat are drawn over the calm left side: CVSS 9.3.

Threat Intel3 Nov 2026

Absolute says Secure Access servers 13.0 to 14.60 have a critical authentication bypass, fixed in 14.61

What Absolute's two CVE records and its 14.61 advisory establish about CVE-2026-116769 and CVE-2026-97718, the four day gap between fix and record, the versions, what is not stated, and a ranked checklist for self hosted Secure Access operators.

A dim warehouse at night in navy blue and amber light. On the right, a cardboard carton open on a pallet, a small black TV set top box inside with its cover off, showing a green circuit board and a blue light. A thin glowing blue line rises from it into the dark ceiling. A dozen closed black boxes with small blue lights lie in rows beside it. The headline and a stat are drawn over the calm left side: 1.3 million.

Threat Intel2 Nov 2026

Google says TV box maker Videostrong built a backdoor into 1.3 million boxes and sold access: its assessment

What Google's XCPE post states and does not: the claim that the maker sold access, how the firmware backdoor works, what Google did, why certification did not stop it, the indicators as printed, and a ranked checklist.

A long corridor in a data centre at night. In the right half a plain scuffed pale grey steel side door stands ajar, a thin bar of white light spilling across the dark floor towards a row of black server racks, each with a small blank paper tag hanging from it. Down the corridor a glowing amber arrow points left towards a closed frosted glass door. The headline and a stat are drawn over the left half: no 1.16.

Threat Intel2 Nov 2026

Control Web Panel's three CVEs say fixed in 1.12 and 1.16; the vendor changelog lists no 1.16 and names no CVE

What the three CWP CVE records, GitHub's advisories, VulnCheck and the vendor changelog state, where GitHub's wording differs from the CVE records, what 1.12 to 1.15 means, the dates, exploitation checks, and a ranked checklist.

A rack mounted 1U grey steel appliance in a dim blue and teal comms room at night. Its perforated front bezel is pulled open to the left and a sealed, plain grey data cartridge sits half inserted in a slot on the front, with one small amber indicator glowing beside it. A pair of plain cream envelopes rests on a wire tray above, and blue patch cables blur in the foreground. The headline and a stat are drawn over the left half: 9.3.

Threat Intel2 Nov 2026

Barracuda ESG CVE-2026-116606: CVE record says unauthenticated, Barracuda says admin access is required

What Barracuda's page, the CVE record, Mandiant's advisory file, NVD and CISA say about CVE-2026-116606, where they disagree on authentication, the companion command injection, the dates, what is not stated, and a ranked checklist.

A small coffee shop counter at dusk in warm amber and cool blue light. A till drawer is pulled wide open and completely empty beside a blank tablet on a stand showing an abstract orange glow with empty rounded pills. On a shelf behind, a small black mini PC has its side panel ajar and one amber status light. The left side is dark blue and carries the headline and a stat drawn over it: 85 days.

Threat Intel2 Nov 2026

BTCPay Server says hot wallet thefts hit 2.4.1 and older via the 2.4.2 flaw; method and losses not stated

What BTCPay Server's own posts and release notes state about the hot wallet thefts, the 85 day gap from the 2.4.2 fix to the first drain, what they leave out, and a ranked checklist for operators.

A cramped small office at night. On a worn wooden shelf stands a four bay desktop storage box with one small amber status light lit above the second drive bay and the others dark, between a white wireless router and a potted plant. Below it, a stack of external backup drives, a blank sticky note and a closed laptop under a warm desk lamp, with cold blue light from a window. The headline and a stat are drawn over the calm left side: 723 days.

Threat Intel2 Nov 2026

Synology warns of ransomware attacks on outdated DSM through a flaw patched in 2024, and names no CVE

What Synology's warning of 29 October 2026 states and leaves out, the fixed DSM build per branch, what the three CVEs are, why the December 2024 date fits only DSM 6.2, what the public reports add, and a ranked checklist for NAS owners.

A small server room at night in cyan and deep red light. On the right, an open storage rack with six disk drive trays pulled half out at uneven depths, and a shelf of stacked grey backup cartridges. In the centre, a laptop on a steel table shows an abstract node graph of blank rounded shapes. A server rack stands behind under a red alarm beacon. The headline and a stat are drawn over the calm left side: 3 victims.

Threat Intel2 Nov 2026

Sophos says Aur0ra ransomware operators let AI agents do the network work after a red team cover story

What Sophos's Aur0ra report establishes about AI agents doing the middle of a ransomware intrusion, how the operators talked past guardrails, what is not stated, the artifacts as printed, and a ranked checklist.

A bank operations back office at night in deep teal light, empty desks and city lights behind. On the right a tall brushed steel cabinet of gateway servers with teal status lights; a small administrator's control panel set into its side stands open, lit warm amber inside, and a plain grey access card rests on the ledge below it. The left side carries the headline: low privilege users could run admin actions through WSO2's System REST APIs, and the stat 280 days.

Threat Intel2 Nov 2026

WSO2 says low privilege users could run admin actions on its System REST APIs; its advisory is 280 days old

A CVSS 9.4 broken access control flaw in WSO2 API Manager, Open Banking and four other products reached the CVE list 280 days after WSO2's advisory. Who can reach the System REST APIs, what the Gateway sentence covers, the fix levels, and a ranked checklist.

A small comms cupboard at dusk in deep blue light. On an open rack stands an old beige tower server; four small USB licence keys in red, blue, mustard and green are plugged into a black hub on its front, and an orange network cable runs from a blank wall port to the server, its connector glowing amber. The left side carries the headline and the stat CVSS 9.8.

Threat Intel1 Nov 2026

One HTTP request with no login may run code as SYSTEM on Thales Sentinel Keys Server, the CVE record says

CVE-2026-78403, CVSS 9.8: what the CVE record says about Thales Sentinel Keys Server, why owners may not know they run it, the 1.3.7.0 public bundle, a KEV check that predates the CVE, what is not stated, and a ranked checklist.

A database administrator's desk at night in a teal and indigo operations room. A large curved monitor shows an abstract tree of blank rounded labels and an empty data grid with one row lit amber. Beside it a brass stand holds a key ring of fifteen blank cream key tags, one glowing amber. The left side carries the headline: an ordinary user's export could run commands on the host, and the stat 15 CVEs.

Threat Intel1 Nov 2026

pgAdmin 4 9.19 fixes 15 CVEs; the worst let an ordinary user's query export run commands on the pgAdmin host

What the 15 pgAdmin CVE records establish: 13 score 7.0 or more, 14 need a login, most bite in server mode. How a backslash beat the Import/Export check twice, what 9.19 breaks on first start, and a ranked checklist.

A data centre entrance in teal and amber light. A brushed steel tripod turnstile stands before a row of black server cabinets with blurred status lights. On its post is a graphite badge reader with a cyan ring, and from a hook beside it hangs a lanyard holding two laminated cards: a blank white card in front of an amber card that looks genuine. The left side carries the headline and the stat CVSS 10.0.

Threat Intel1 Nov 2026

LXD and MicroCloud trusted any certificate in a client's chain, so a public certificate could log in as it

CVE-2026-112816, CVSS 10: what Canonical's advisory and CVE record say about the leaf versus chain flaw in LXD and MicroCloud, who meets the two preconditions, the fixed snaps by channel, the Incus fix, what the score does not establish, and a ranked checklist.

A dark smartphone lies face up on teal slate with a dead black screen, a severed coiled telephone cable beside it and a sealed blank envelope. Cold cyan light edges one side and warm amber the other. The calm left side carries the headline drawn over it: one text can crash an Android phone, a researcher says, and Google's October bulletin names 25 CVEs, none this fix.

Threat Intel31 Oct 2026

Android 'SMS of Death' exploit is public: fix is in October's code, not Google's bulletin; CVE only reserved

What the researcher, Google's October bulletin and public fix commit, and the CVE Program show about the Android SMS of Death crash: which claims conflict, which versions are affected, what the fix changes, and a ranked checklist.

An appraiser's counter in warm amber and deep teal light. A tall brass balance scale with two empty pans stands on the right. In front, a teal velvet tray holds a heap of old brass keys, blank metal discs, a small glass vial and polished stones, and three small brass dishes sit on stepped wooden blocks of rising height, the tallest holding gold coloured discs and amber. A brass loupe rests on a cloth. The headline and a stat are drawn over the calm left side: 1 sample.

Threat Intel31 Oct 2026

Talos says VOLTA stealer has an LLM rank victims' assets and falls back across 3 models; one sample listed

What Cisco Talos's VOLTA report establishes about a stealer that asks a model to rank victims, the three model chain, what is not stated, the artifacts as printed, and a ranked checklist for defenders.

A heavy brass key ring with a cluster of identical brass keys hangs from a black iron hook in front of a wall of small steel padlocks on dark teal plate, one padlock hanging open. The left half is a calm dark teal blur carrying the headline and a stat drawn over it: no interception seen, over half still trust, 50M probes.

Threat Intel31 Oct 2026

Cloudflare: no interception seen from eMudhra's weak keys, yet over half of large network probes trust them

Cloudflare says about 160 of 22,000 weak key handshakes stood out and none was interception, and that its 50 million probes show unpatched clients on large networks. What the post states, and what it leaves out.

A tilted brushed steel funnel on a teal table pours a stream of several hundred tiny identical brass beads toward a small unmarked wooden gate at the right. Two large dark glass spheres rest still and untouched at the left, edged in amber light. On the left, drawn text reads 18.2M attacks, 96 percent under 10 minutes, with a source line naming Cloudflare.

Threat Intel31 Oct 2026

Cloudflare's Q3 DDoS report counts 18.2 million network layer attacks, 96% under 10 minutes: what it measures

What Cloudflare's DDoS Threat Report 2026 Q3 counts and compares: 18.2 million network layer attacks, the 208 and 38 percent changes, 251 giants against swarms, the takedown claim, and a ranked operator checklist.

A walnut desk in teal and amber light with a large fanned stack of blank ornate cream certificates, the top one carrying a red wax seal, a brass rubber stamp beside it, a closed graphite laptop, an unplugged headset and a coiled telephone cord blurred in the foreground. On the left the headline reads: Help desk impersonation on Teams led to AD CS abuse, Microsoft says. ESC1 AND ESC8, two certificate abuse paths after one Teams and Quick Assist entry.

Threat Intel30 Oct 2026

Microsoft says Teams help desk impersonation led to AD CS abuse in two intrusions, via ESC1 and ESC8

What Microsoft's post of 30 October 2026 states about ESC1 in one intrusion and PetitPotam with ESC8 in the other, what the excluded account cost, what it leaves out, the queries it prints, and a ranked checklist.

A single matte grey network security appliance on a brushed steel shelf, with a row of empty network ports, a dark unlit red status lamp, two small brass keys on a ring and a blank paper tag hanging from its black handle, in cold white and amber light. On the left the headline reads: Two Ivanti Connect Secure flaws join CISA's exploited list. 17 DAYS since the 13 October listing, derived.

Threat Intel30 Oct 2026

CISA KEV adds Ivanti CVE-2026-118527, CVE-2026-111357; Ivanti lists 22.8R2.5 and 25.1.1.2 as affected

What CISA's two Ivanti Connect Secure entries print, how they connect to the October chain, why one gets three days and the other fourteen, where Ivanti, MITRE and CISA disagree, and what the listing does not establish.

A smartphone lies face down on a dark walnut desk at dusk, its plain back showing three camera lenses, beside a closed teal notebook with a pair of tortoiseshell reading glasses on it, a coiled navy lanyard and a blank press badge in a clear holder. A blurred office window glows indigo behind. The left half carries the headline and a stat drawn over it: 99 countries.

Threat Intel30 Oct 2026

Apple says threat notifications reach 99 countries, over 150 in total, naming no attacker or people count

What Apple's support page and CyberScoop's quotation say about the 99 country batch, what neither states, why 110 and 99 cannot be added, what no notice does not mean, the helpline's limit, and a ranked checklist for recipients, at risk people and newsrooms.

A planning table in cool teal light with a large blank world map, dozens of small silver pins joined by thin red thread that fans out from one point in Europe, several pins glowing amber, and a closed graphite laptop with a plain lid beside it, a spool of red thread blurred in the foreground. On the left the headline reads: ARTEX aimed at 200+ organisations, nine confirmed, CrowdStrike says. 9 OF 200+, post exploitation confirmed at nine.

Threat Intel30 Oct 2026

CrowdStrike says VAPOR PANDA used ARTEX against more than 200 organisations; nine confirmed with BLOODALCHEMY

What CrowdStrike's post of 29 October 2026 states about VAPOR PANDA, ARTEX, DeepSeek and BLOODALCHEMY, what each number counts, what it leaves out, the indicators it prints, and a ranked checklist.

A quiet home entry hall in warm evening light from a tall window. On a narrow wooden console table stand three plain brown cardboard shipping boxes, each with one blank white label, beside a silver closed laptop with a blank pale yellow sticky note on its lid and a second silver laptop lying flat. The left half is a calm dark teal wall, with the headline and a stat drawn over it: a cleared contractor employee pleads guilty, OFAC sanctions 10 and one entity, same day, 10 plus 1.

Threat Intel30 Oct 2026

Defense contractor employee pleads guilty in DPRK IT scheme; OFAC sanctions 10 and one entity, no stated link

What the Justice Department and Treasury releases state about the plea and the 11 designations, what only CyberScoop reports from court records, what neither release says about a link, the printed crypto addresses, and a ranked checklist for employers hiring remote staff.

A row of seven identical small tin toy robots with blank cream name tags stands on a worn wooden table in amber and violet light, and the nearest holds a thin lockpick in the keyhole of a small brass padlock. The left side is deep violet and carries the headline over it: One scanner, about 32 fake AI bot names, with the stat ABOUT 32 and the note AI bot identities, says Cequence.

Threat Intel30 Oct 2026

Cequence says one scanner posed as about 32 AI bots, ChatGPT and Claude among them, to hunt .env and SSH keys

What Cequence's post of 28 October 2026 measured, how it says it spotted the impostor, why a user agent proves nothing, a ranked checklist for site owners, and what the vendor does not say.

A night time warehouse loading bay. On a wooden pallet stand three open pale pine crates with packing straw and brown paper parcels half lifted out, as if being unpacked. Beside them a grey steel side door has been left ajar, with the bolt unlatched and a wedge of cold light on the floor. A clipboard with blank sheets hangs on the wall. The headline on the left reads: WordPress update race: attempts within hours of the 7.1.4 patch. 18,500+.

Threat Intel30 Oct 2026

WordPress 7.1.4 update race RCE: Wordfence counts 18,500 installer path requests in 21 hours, no CVE yet

What Wordfence, WordPress and the 7.1.4 source files establish about the unauthenticated update race condition: the first match, the 18,500 requests, the fixed versions, why automatic updates are not a clean answer, and a ranked checklist.

A rugged dark laptop with a blank screen open on a desk in cold light, beside a grey courier pouch whose pale orange security seal has been cut into two bands, and an open disc case holding one plain disc. The left of the picture is deep teal and carries the headline over it: Kaspersky: NetamLoader was aimed at a government Windows 10 build, with one system the only one in Kaspersky's telemetry.

Threat Intel30 Oct 2026

Kaspersky says NetamLoader malware targets a government only Windows 10 in Asia; how it arrived is unknown

The infection chain step by step, which parts were legitimate, the indicators as printed, what Kaspersky infers about a supply chain route, and what the report leaves open: delivery, country, scale and actor.

A technician's repair bench in warm lamp light with an open laptop, a canvas roll of small screwdrivers and a magnetic tray of screws. A long black cable runs from a small hatch cut in the wall, where a second dark laptop sits in shadow, across the bench into the technician's laptop. The left half is a dark teal blur carrying the headline over it: a hostile host can attack the technician's TeamViewer, CVE-2026-111585, fixed 15.83, and the score 8.8.

Threat Intel30 Oct 2026

TeamViewer CVE-2026-111585: a malicious host can attack the support technician's viewer, fixed in 15.83

The CVE, the affected and fixed builds, what the attacker needs, the stand in behind Remedio's code execution demonstration, where the pages disagree, and a ranked checklist for help desks and managed service providers.

A tidy office desk in warm evening light through window blinds. A black desk telephone with a blank keypad has its handset off the hook, lying on a looped coiled cord beside an open ring bound staff directory whose pages show only grey bars, with amber and teal sticky notes along its edge and a teal coffee mug behind. The left of the picture is deep teal and carries the headline Talos: fake help desk calls, no count printed, and a stat: 37 percent.

Threat Intel30 Oct 2026

Cisco Talos on fake IT help desk callers: no call count in its Q3 report; 'names and emails' is a Q&A quote

What the Talos Q3 post counts and does not, which claims sit only in Help Net Security's Q and A, which way the calls went, the controls named by Talos and Microsoft, and a ranked checklist.

The counter of a small shop at closing time. A cream and brass cash register on the right has its drawer pulled open, with a brass key on a ring hanging at the front of the empty till. A long ribbon of blank white receipt tape unspools from the register, curls over the walnut counter and trails to the lower left past wrapped parcels and a paper bag. The left carries the headline: Drupal says Commerce Core access bypass is exploited, CVE-2026-118539, and the figure 21/25, Drupal's own score.

Threat Intel30 Oct 2026

Drupal says Commerce Core flaw CVE-2026-118539 is exploited; fixes are out, but the advisory gives no detail

What the Drupal advisory states and leaves out about CVE-2026-118539, the arithmetic behind 21 out of 25, the six advisories fixed in 3.3.13 and 8.x-2.41, the branch it does not name, and a ranked checklist for store owners.

A planning table at night under a warm desk lamp. A blank cream paper map of the world's landmasses has a small wooden block near its centre with dozens of taut red threads running to brass pins. One bundle of threads has been cut and its loose ends curl on the paper beside open steel scissors. A tin of pins and a coil of red thread are blurred at lower left. The headline and the figure 180,000 are drawn over the dark teal left side.

Threat Intel29 Oct 2026

ASD tells ABC it disconnected an Amadey controller from 180,000 computers; no date or method published

What ASD is reported to have done to an Amadey controller, what the 180,000 may and may not count, how Amadey is rented out in 53 clusters, and what a defender should check. Read 29 October 2026.

A dark petrol blue factory bay. A graphite conveyor belt carries identical blank white modules toward a heavy orange steel inspection gate with a glowing orange warning lamp on top. Under the gate one module has stopped with a blank red paper ticket stamped with a plain red ring hanging from it. A brass hand stamp rests in a tray beside the belt. The headline on the left reads: CISA lists GitLab CVE-2026-97229 as exploited. 3 DAYS.

Threat Intel29 Oct 2026

CISA lists GitLab CVE-2026-97229 as exploited: three days and forensic triage for federal agencies

What CISA's KEV entry for GitLab CVE-2026-97229 says and does not say, what BOD 26-04 changes against BOD 22-01, why the fixed version it points to is not the newest, and a ranked checklist with evidence first.

A warm lamp lights a slim black server chassis on a steel workbench. A braid of cyan, white and amber network patch cables sweeps in from the left and plugs into its row of empty sockets, while one amber cable hangs in the air with its plug just short of a socket. The chassis front carries only plain status lights. The left half is dark teal, with the headline and the stat 9.8 vs 8.1 drawn over it.

Threat Intel29 Oct 2026

CVE-2026-98432 Linux TCP flaw: 9.8 per kernel CNA, 8.1 on Red Hat's page, and no Ubuntu or RHEL fix listed

What the CVE record, Ubuntu, Red Hat, SUSE, Debian, Oracle and Amazon print for CVE-2026-98432: the bug, four distinct scores and the one letter that separates them, who has a fixed kernel, exploitation status, the artifacts and a ranked checklist.

Two near identical white software boxes on a dark bench in warm amber and cool cyan light. Each has a blank indigo rounded square and two empty grey bars. The left box is pristine with a crisp red ink ring stamp; the right one is crooked, torn at the top fold, a shade too purple, with a smudged stamp seen through a brass magnifying glass. A brass stamp and ink pad lie in front. The headline on the left reads: Fake ChatGPT and Claude apps ran genuine signed files, then a miner. 85 seconds.

Threat Intel29 Oct 2026

Check Point: Yoba malware hid behind genuine signed OpenAI and Anthropic files in fake ChatGPT and Claude apps

What Check Point's Yoba report says about fake ChatGPT and Claude apps on GitHub: what the signature on the genuine file covers, the 85 seconds between the DLL build and the upload, what is not stated, hunting artifacts and a ranked checklist.

An investigator's desk at dusk in teal and amber light. A large monitor shows a web page replaced by a blank seizure notice: a plain round disc and empty grey bars. Beside it a small black server still shows green lights. In front lie a clipped stack of blank papers and an evidence bag holding a network cable and a brass padlock. The headline on the left reads: Virtualine's domain is seized. The DOJ says its host still serves a flagged site. 1 domain.

Threat Intel29 Oct 2026

Virtualine domain seized, but the Justice Department says the bulletproof host still serves a flagged site

What the Justice Department release on the Virtualine seizure states and leaves out, the registry record, TRM Labs' one fifth figure and the dollar base it does not print, who said ransomware, and a ranked defender checklist.

A branch office workbench at dusk in teal and amber light. A dark network firewall appliance with blank panels and a row of ports lies on a scuffed steel bench; a bright amber cable leaves its end port, arcs up and runs out through the window toward a blurred city skyline. An open brass padlock and a small grey computer sit beside it, blue cable coiled in front. The left side carries the headline and a stat: 0 of 15.

Threat Intel29 Oct 2026

Palo Alto says PHP2Shell flaw CVE-2026-109618 is now exploited against exposed PAN-OS management interfaces

What Palo Alto's PHP2Shell advisory now says about PAN-OS and Panorama, how its wording and score changed, the fixed hotfixes, the four conditions behind its signature mitigation, and what it leaves out.

A home office at night in teal and crimson light. A large desktop monitor glows deep red with a blank lock screen layout of empty rounded boxes. In front, a dark keyboard has a few keys lit amber, with a thin amber trail rising to the screen. A brass key with a blank paper tag lies on the keyboard, and a small receipt printer pushes out a curl of blank paper. The headline and a stat are drawn over the calm left side: 1 of 16.

Threat Intel29 Oct 2026

Cisco Talos: NIK C2 implant calls OpenAI from the victim's PC and can spend the victim's own API key

What Cisco Talos's NIK C2 report establishes about the implant's OpenAI call, whose key pays, what is not stated, how it differs from Microsoft's SesameOp, the indicators as printed, and a ranked checklist.

Blue hour at a satellite ground station. A weathered grey outdoor network cabinet stands open on a concrete plinth, a dark network appliance inside with blue and yellow cables, a ring of brass keys hanging from the inside of the door, and a thin amber cable running away across the gravel. Large white satellite dishes stand behind under a warm lamp. The left side carries the headline and the stat 245 days.

Threat Intel29 Oct 2026

Cisco Talos says UAT-11473 used CVE-2026-20127 to plant KeyDrift, malware built to collect Cisco SD-WAN keys

What Talos's KeyDrift report establishes about PolyFlame, LittleFilch and the keys they target, what it leaves out, who links it to Volt Typhoon and how far, the CVE-2026-20127 record, and a ranked checklist with every path Talos prints.

A small network cupboard at night. A plain charcoal firewall appliance sits on a worn oak shelf on the right, amber status lights glowing as if mid restart, blue and green network cables looping from its ports. Behind it a laptop shows an empty login window. The left side is calm indigo with the headline: Cisco ASA and FTD VPN flaw exploited, and August's fixed builds affected, 13 of 13.

Threat Intel29 Oct 2026

Cisco says ASA and FTD SSL VPN flaw CVE-2026-76418 was exploited, and lists August's fixed builds as affected

What Cisco's advisory and data file state about CVE-2026-76418: the three conditions, the tunnel group checks, the fixed builds, the August flaw it follows, what is not stated, and a ranked checklist.

A teal lit datacentre aisle at night. A black server rack fills the right side with one plain rack server pulled half way out, its lid open and glowing amber. In front of it on a small steel cart a long blank fan fold paper printout falls to the floor. The left is calm teal, with the headline drawn over it: a Low rated ESX flaw is listed as exploited, CVSS 2.7.

Threat Intel28 Oct 2026

CISA lists VMware ESX CVE-2026-41709, rated Low by Broadcom, as exploited; CrowdStrike says it was a zero day

What CISA, Broadcom's CVE record and FAQ, and CrowdStrike state about CVE-2026-41709, the dates, what exploited and forensic triage mean in CISA's rules, the other four flaws in the advisory, the build traps, and a ranked checklist.

A university records office in late afternoon light. A long oak counter in the foreground carries a brass ring with three identical brass keys hanging from one blank brass tag, with oak filing cabinets and a sunlit window behind. The left side is calm and dark green, with the headline and a stat drawn over it: One CVE, three bugs, ZDI says, 3 BUGS.

Threat Intel28 Oct 2026

ZDI says Oracle's PeopleSoft CVE-2026-35273 covers three separate bugs, and Oracle's alert names one component

What ZDI's three advisories and its 27 October blog say about CVE-2026-35273, how the three bugs line up with Mandiant's account (our reading), what Oracle's alert leaves unsaid, dates with derived durations, and a ranked checklist.

A workshop bench at night. A wide monitor shows a browser window drawn only with blank rounded shapes: three tabs, an address pill and four cards. In front stands a clear acrylic cube with its door open and undamaged, and a short brass chain of five different links runs from it to a keyboard. Text on the left reads: An Edge sandbox escape of logic bugs, author says. $175,000. Paid at Pwn2Own Berlin, May 2026.

Threat Intel28 Oct 2026

Pwn2Own paid $175,000 for an Edge sandbox escape its author says used five logic bugs and no memory corruption

The Edge chain, step by step from the researcher's own account: what ZDI paid, what Microsoft's notes and three CVE records show was fixed on 15 May, and what the public record does not say.

A large open rack server pulled out on rails in a dim data centre aisle, lit amber from inside, showing a green circuit board with a processor socket and memory slots. A teal network cable is plugged into its front port and a small brass padlock hangs open from the rack ear. The left half is a calm blurred teal aisle carrying the headline and the stat drawn over it: 5,834 days.

Threat Intel28 Oct 2026

TianoCore says a PXE flaw in EDK II code dating to 2010 can run code before Secure Boot; no stable fix

What the TianoCore advisory and CVE record state about the EDK II PXE network boot flaw, where the 16 year age comes from, who the sources say can send the packet, six stages of a fix, the maintainers' patch, and a ranked checklist. Defender level only.

A telecom equipment room in teal and indigo light. On a steel shelf a chain of unmarked network devices stands in a row, joined by pale teal patch cables: a black router with two antennas, a tall white router, a round white mesh unit, a flat grey router and a larger grey firewall appliance in a rack, with blank rounded slots and a row of indigo lights. A coil of cable and a discarded router lie in a box in the foreground. The headline and a stat are drawn over the calm left side: 0 indicators.

Threat Intel28 Oct 2026

Lumen says Volt Typhoon ran four confirmed zero day campaigns through disposable relay chains and prints no indicators

What Lumen's report on Volt Typhoon's Silent Train framework states and leaves out, the five platforms and CVE ids checked against CVE.org and CISA, the ports and hunting advice it prints, and a ranked checklist for management platform owners.

A warm daylit mailroom sorting table. Eight grey plastic trays stand in a row, each holding an upright stack of plain blank cream envelopes and each with one red tab clipped to its front, with a blank cream franking machine and pigeonhole shelves blurred behind. The left is a calm cream and sage wall carrying the headline and a stat drawn over it: 8 critical.

Threat Intel28 Oct 2026

Adobe says build 9403 fixes eight critical Campaign Classic flaws, after 36 earlier records since June

Eight Adobe Campaign Classic CVE records, scored 9.1 to 10.0 by Adobe, and the ladder of 44 records and eight fix builds since June. What is stated, what is not, a ranked checklist.

A network equipment rack at night in deep indigo and cool blue light. Seven black rack mounted firewall appliances with blank rounded panels and rows of ports are stacked, most with cyan status lights, one with a red light, one glowing amber. A bright cyan patch cable leaves the amber unit, loops out of the rack and runs away across the floor into the dark. The left side carries the headline and a stat: 52.4 hours.

Threat Intel28 Oct 2026

Dream says a chained PHP2Shell and kernel exploit rooted 25 servers, three in a US government affiliated network

What Dream's incident report states and leaves out: the 19,000 to 25 funnel, the PHP 8.0.30 branch, the unknown vendor, what was done inside one network, and how far the China and AI evidence goes.

A data centre aisle at night in deep teal light. A black steel server cabinet with a mesh door fills the right side. A new polished brass lock and steel latch sit on the door, and beside it a small steel shelf holds a set of slim lock picking tools. Below, a trolley carries a stack of blank paper ledgers with an elastic band. The left half is calm dark teal, with the headline and a stat drawn over it: 7 days.

Threat Intel28 Oct 2026

Defused says its decoys logged exploit attempts at Oracle EBS CVE-2026-101767 7 days after the patch

What Oracle, CVE.org, NVD, CISA and Horizon3.ai state about CVE-2026-101767: affected versions, the 9.8 score, the 7 days from patch to a decoy hit, what is not stated, the 30 other unauthenticated fixes, and a ranked checklist.

A back office desk beside a factory floor at dusk, with a large open laptop showing a dark sign in card made only of empty rounded shapes and a row of eight blank cells, a manila folder shut with a brass padlock, a phone showing one empty bar and a desk lamp. The left side carries the headline and a stat drawn over it: 618 runs.

Threat Intel28 Oct 2026

ANY.RUN says its SkyW4lker device code phishing kit appears in 618 sandbox analyses, and counts no victims

What ANY.RUN's SkyW4lker report counts and does not, how the device code flow is abused, the Gabagool link, the Conditional Access setting that blocks it, and the indicators as printed.

A dark desk at night. An open laptop shows a list of nine blank rounded rows, four of them dimmed and outlined in amber as removed. A USB stick is plugged into its side and an unplugged network cable lies coiled in front. The left half is dark, with the headline and a stat drawn over it: Microsoft says it removed six eMudhra roots, 9 days.

Threat Intel27 Oct 2026

Microsoft says its out of band updates remove six eMudhra roots from Windows, but only the Update Catalog offers them

What Microsoft's 26 October post and eight KB pages state about the eMudhra root removal, the Catalog only delivery, the gap between its six roots and the three the tracker lists, what the other root programs did and when, and a ranked checklist.

A dark desk at night. An open laptop shows an online shop page drawn as a grid of blank product tiles, one tile outlined in amber. A stack of three plain cardboard parcels with blank labels stands behind it and a handheld card terminal lies in front. The left half is dark, with the headline and a stat drawn over it: 105 days.

Threat Intel27 Oct 2026

CISA lists Adobe Commerce and Magento CVE-2026-48356 as exploited, 105 days after Adobe's July patch

What CISA's KEV entry, the CVE record and Adobe's bulletin establish about CVE-2026-48356, where they disagree, what the entry leaves out, the 10 November federal deadline and the table behind it, and a ranked checklist with Sansec's published checks.

A dark workbench in cool blue light. A pale grey unmarked network gateway with four dark status lamps and a blank rounded plate sits on the right with a pale blue Ethernet cable plugged into it. A blank white smart card with a gold chip and a hole punched through one corner lies in front. The left half is empty dark blue with the headline and a stat drawn over it: 1 of 256 bytes.

Threat Intel27 Oct 2026

GoAhead advisories say OpenSSL builds accepted revoked client certificates and mbedTLS builds sent a 1 byte DH prime

What the GoAhead 6.1.1 advisories establish about revoked client certificates and session decryption, the conditions each needs, the arithmetic of the one byte prime, what is not stated, the 71 day gap between device builders and publication, and a ranked checklist.

A dark desk at night. An open laptop shows a checkout form drawn as blank rounded pills with a plain indigo button. In front of it lies a blank dark payment card with an empty chip square, and at the far right a small black unmarked box is joined to the laptop by a glowing cyan cable. The left half is dark, with the headline and a stat drawn over it: 79 hours 51 minutes.

Threat Intel27 Oct 2026

Sansec says a Magecart group hid a card skimmer in Convertr's analytics script, loaded on every checkout

What Sansec's report on the Convertr analytics script establishes, what it leaves out, the arithmetic of the exposure window, the CVE that names a library, why the 953 stores story is a separate finding, the indicators, and ranked checklists.

A dark desk at night with an open silver laptop at the right. Its screen shows a plain list of ten blank rounded rows, each with a small padlock shape at the left, three of them tinted amber. A worn brass skeleton key with a blank tag lies on the desk in front of the laptop. The left side of the picture is empty dark blue with the headline and a stat drawn over it: 13,500+.

Threat Intel27 Oct 2026

Wiz says Gheist used stolen GitHub tokens to dump secrets from private repos, where GitHub's new hold does not apply

What Wiz's post of 25 October 2026 and GitHub's own documentation establish about Gheist, a stolen token campaign. The hold covers public repositories only, so private ones are outside it. Indicators, audit log events and a ranked checklist.

Two unmarked smartphones lie side by side on a dark slate desk. The newer phone on the left has a small round camera cut out and a solid teal blank pill on its screen. The older phone on the right has a wide notch and an amber outlined blank pill, still waiting. A brass sand timer with most of its sand run down stands between them and a white charging cable is coiled in the foreground. The left third is empty dark blue, with the headline and a stat drawn over it: 28 days.

Threat Intel27 Oct 2026

Apple's iOS 18 fix for a CoreGraphics flaw it says may have been exploited came 28 days after iOS 26's

What Apple's pages, the CVE record and CISA's KEV file establish about the CoreGraphics fix on iOS 18, how the 286 count is built, which devices have a fix and which have none listed, and a ranked checklist.

Threat Intel27 Oct 2026

Arctic Wolf reports 400+ Teams external chat incidents; its 15 minute clock starts at victim engagement, no breach count

What Arctic Wolf's 26 October report counts and does not, the chain it describes, Microsoft's Teams external access settings by exact name, a conflict between two recommendations, hunting queries and a ranked checklist.

A dark desk in cool blue light. A black flat monitor with an unmarked bezel shows a catalogue of twelve blank rounded rows, the middle two filled amber. Beside it stand a plain paper desk calendar with a grid of blank cells, three adjacent cells covered by one red strip of tape, and a blank clipboard. A server rack with small status lights blurs behind. The left of the picture is empty dark navy carrying the headline and a stat: 3 DAYS.

Threat Intel27 Oct 2026

CISA adds both PHP2Shell flaws to its exploited list with a three day federal clock but names no evidence

What CISA's catalogue entries, alert and directive state about the two PHP2Shell flaws, the clock from the fix to the 29 October due date, what the listing does not establish, and a ranked checklist for defenders.

A dark desk in cool blue light. A matte black smartphone with a lit screen shows a card made only of empty rounded shapes: four empty boxes, an empty ring and a cyan pill button. A plain white paper half mask leans against it and a blank grey work badge on a lanyard lies in front. The left half is empty dark blue with the headline and a stat drawn over it: Enclave says a rogue Android app could take Authenticator tokens, CVSS 8.6.

Threat Intel27 Oct 2026

Enclave says a zero permission Android app could take Authenticator tokens; Microsoft rates CVE-2026-80097 8.6

What Microsoft's advisory, the CVE record and Enclave's research post state about CVE-2026-80097 in Microsoft Authenticator for Android: the fixed build, the score, the user step the two sources describe differently, what is not established, and a ranked checklist.

A dark desk in blue light. An unmarked dark grey laptop shows an update window made only of empty rounded shapes, one outlined in cyan, with a blue button shape. In front of it sit three plain brown taped parcels, one wearing a blank cream tag with a red strip. The left half is empty dark blue, with the headline and a stat drawn over it: Brotli flaw, Microsoft rates it 8.1, Google's record 9.2.

Threat Intel26 Oct 2026

Microsoft scores the Brotli flaw 8.1 where Google's record says 9.2, and PHP's Windows fix keeps its version number

What Microsoft, PHP and the CVE record state about the Brotli decoder flaw on 26 October 2026: the scores and severity labels, the fixed .NET, PowerShell and PHP Windows versions, who coined HTTP2Shell, Node2Shell and Broccoli2Shell, and a ranked checklist.

Threat Intel26 Oct 2026

Kali Linux 2026.3 adds six tools and kernel 7.1.5; Kali's pages list all six only under the 'everything' set

What Kali's 2026.3 post states and leaves out: six tools listed only under the everything metapackage, a screenshot dated 24 September, images built 9 October, and how Kali says to verify a download.

A dark room with three flat pale grey rack mounted network appliances stacked in an open black rack, each with a blank recessed plate, a row of empty ports and a few black cables. In front, on a steel shelf, lies a closed slate grey document folder held shut by a blue band. The left half is empty dark blue, with the headline and a stat drawn over it: 19 days.

Threat Intel26 Oct 2026

Fortinet says critical and high severity fixes are out for five product lines, with advisories held to 10 November

What Fortinet's announcement, change logs and policy establish about its hardening release: the 17 fixed versions, the 19 day gap, what the release notes list, and the upgrade steps to take before the advisories arrive.

A bare hand holds a plain dark blue bank card with only a gold chip square against the back of a matte graphite smartphone in a rainy dusk street, with a thin cyan glow between them. A cash machine is out of focus at upper right. The left half is dark and carries the headline, 170 victims and a one line note.

Threat Intel26 Oct 2026

Dutch police say a caller's app relayed victims' card chip data to an accomplice: 170 victims, about 380,000 euros

What the Dutch police release states about the NFC card scan fraud, what it leaves out, the arithmetic behind 380,000 euros and 170 victims, where SecurityWeek differs from the primary, how NFC relay works at defender level, and a ranked checklist for customers and bank fraud teams.

A dark laboratory bench in dim blue light. Three identical black rack servers with blank recessed label plates stand stacked in an open steel rack on the right. A silver open laptop in front shows a navy window of blank grey bars and one short block. The left half is empty dark blue, with the headline and a stat drawn over it: 35 shells.

Threat Intel26 Oct 2026

Researcher reports 35 Apache shell starts on three PHP2Shell honeypots running PHP 8.4.26, three days after the fix

What the honeypot report establishes about PHP2Shell exploitation and what it does not, the claims retracted before it, the fixed versions, defender detections as printed, and a ranked checklist.

A dark room with one slim server rack on the right holding five identical servers, the top one with a red indicator, the second amber and the rest pale, joined by a single black cable. The left half is empty dark blue and carries the headline, Tailworm: 11 claimed flaws in Tailscale and headscale, no CVE, no fixed release, and the stat 18 changes: SSH and serve code merged since Saturday, none released.

Threat Intel25 Oct 2026

Tailworm claims 11 flaws in Tailscale and headscale: no CVE or fixed release, 18 code changes merged

What the Tailworm report, Tailscale, headscale and their repositories print about eleven claimed flaws: the chain at defender level, the dated record, the friendly names, the technical artifacts and a ranked checklist.

A dark editorial scene for the briefing, with its headline and key figure drawn over it.

Threat Intel25 Oct 2026

CISA lists shared hardcoded root CA key and missing authorization flaw in Moxa AIG-302 gateways

CISA's advisory ICSA-26-293-03 lists two Moxa AIG-302 flaws fixed in firmware 1.4.1: a shared hardcoded root CA private key (CVSS 4.0 8.6) and a missing authorization check (6.9). Adjacent network access is required.

A dark panel with a notice that this briefing has been withdrawn for rewriting.

Threat Intel25 Oct 2026

Ruby Onigmo briefing withdrawn: it misstated who assigned the CVEs, GitLab's fix dates and the defender advice

Why this Ruby Onigmo briefing was withdrawn and what Ruby's post and GitLab's patch releases say.

Threat Intel25 Oct 2026

Linux kernel maintainers scramble after KSMBD remote execution flaws leak to LKML

Dual CVSS 9.0 remote code execution vulnerabilities in the Linux kernel in-tree SMB server KSMBD leaked to public mailing lists, exposing hosts to pre-auth protocol confusion and heap memory corruption.

Threat Intel25 Oct 2026

Cisco patches maximum-severity root remote code execution in Expressway Series

Cisco discloses CVE-2026-76466, a critical CVSS 9.8 remote code execution flaw in Expressway-C and Expressway-E clustered database services allowing unauthenticated root OS control with no workarounds.

An editorial image of a laptop with a blank social publishing calendar, headed Postiz Security, Files and Tokens, with version 2.25.3 highlighted.

Threat Intel24 Oct 2026

Postiz fixes three critical file-read and token-forgery flaws across two releases

A version-by-version guide to three Postiz CVEs, the file and token trust boundaries they break, and what operators should check.

Threat Intel24 Oct 2026

Third PHP flaw briefing withdrawn: it duplicated another briefing and invented scores, versions and a mechanism

Why this briefing on the third PHP2Shell flaw was withdrawn and where the corrected account is.

Threat Intel24 Oct 2026

Operation IXIM: Eye Security says it served over 2 million updates that disabled an abandoned Popcorn Time updater

What Eye Security reported at Hack.lu on 22 October 2026 about Operation IXIM: how it found the abandoned Time4Popcorn updater (CVE-2026-30612), what its update did and did not do, why a download count is not a device count, and what defenders should check.

Enterprise cloud storage server racks illuminated with subtle amber and cool blue telemetry indicators, surrounded by floating translucent document silhouettes.

Threat Intel24 Oct 2026

Collabora CODE CVSS 9.2 command injection added to CISA KEV

Technical autopsy of Nextcloud Collabora Online Built-in CODE Server CVE-2026-110447: CVSS 9.2 command injection in proxy.php, three-day CISA KEV remediation order, webshell deployment, and password vault scraping.

Threat Intel24 Oct 2026

Kaspersky says BlackX bootkit, similar to BlackLotus, bypassed Secure Boot on patched PCs without PCA 2011 revocation

What Kaspersky GReAT reports about BlackX, a UEFI bootkit that exploits Baton Drop (CVE-2022-21894) to install custom Machine Owner Keys on fully patched Windows machines, what it does not state, and which Microsoft revocation steps defenders have to run themselves.

Enterprise media server rack illuminated with neon amber and cyan data streams, network packets flowing into internal loopback routing and transcoder frames converting into ELF shared objects.

Threat Intel23 Oct 2026

CISA adds Plex2Shell unauthenticated RCE chain to Known Exploited Vulnerabilities catalog

Technical autopsy of the Plex2Shell exploit chain (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656): loopback token theft, x264 dump-yuv carrier video writes, unsigned codec dlopen execution, and CISA KEV listing.

$A luminous geometric orange and violet polygon with spidering crimson fractures floating above enterprise server racks and cascading regular expression code syntax.$

Threat Intel23 Oct 2026

GitLab issues emergency patches for maximum severity CVSS 10.0 integer overflow RCE

Technical breakdown of GitLab emergency release: CVSS 10.0 integer overflow CVE-2026-110264, Ruby Onigmo regex compiler heap corruption, 4,535-day exposure window, and seven-train backport matrix.

Threat Intel23 Oct 2026

Microsoft says Storm-0940 used ARTEX AI agents to try sign-ins at more than 2,250 tenants via ConnectWise

What Microsoft says Storm-0940 did with the ARTEX AI framework after the ConnectWise Cloud Backup compromise: sign-in attempts to more than 2,250 tenants, a password spray that peaked at 2,900 failures a minute, and what is not established.

Dark data centre racks with glowing cabling and a cluster of crystalline nodes, with the headline and the version 1.107.0.

Threat Intel23 Oct 2026

LiteLLM supply chain attack poisons official PyPI and Docker builds with Python startup backdoor

LiteLLM version 1.107.0 compromised on PyPI and Docker Hub via stolen GitHub CLI OAuth tokens, injecting a Python startup backdoor and credential stealer.

Abstract high-tech 3D network topology visualization of glowing enterprise wireless mobility controllers and radio access points transmitting illuminated data packets.

Threat Intel23 Oct 2026

HPE Aruba patches 72 vulnerabilities in wireless operating systems including eight CVSS 10.0 RCE flaws

HPE Aruba bulletin HPESBNW05162 patches 72 flaws across AOS-8 and AOS-10 wireless operating systems, including eight CVSS 10.0 remote code execution vulnerabilities.

Abstract geometric visualization of glowing perimeter firewall gateway nodes subjected to automated exploit scanning and data exfiltration pipelines.

Threat Intel23 Oct 2026

Threat actor k0t breaches enterprise firewalls exposing 70,000 credentials for ransomware gangs

Group-IB and NyxLab expose threat actor k0t compromising Fortinet and Palo Alto firewalls to harvest 70,000 credentials feeding Qilin and The Gentlemen ransomware.

Threat Intel23 Oct 2026

Russia-aligned UAC-0099 and Sandworm hid a backdoor's C2 in the Yggdrasil mesh before a data wipe in Ukraine, ESET reports

ESET's account of an intrusion at a Ukrainian grain logistics company: UAC-0099 initial access, a Go backdoor with its command server inside the Yggdrasil mesh, and a Sandworm wipe two months later.

Threat Intel23 Oct 2026

Microsoft 365 token spraying compromises 79 organisations across 70 days without passwords

What Huntress reported on 22 October 2026: a ten-week Microsoft 365 token-spraying campaign, at least 497 successful sign-ins at 79 organisations, rogue Entra devices, replaced MFA methods and hidden inbox rules, and what Huntress advises defenders to do.

Threat Intel23 Oct 2026

PHP advisory on CVE-2026-115560: an unlikely session upload RCE vector, with the fix due in the next regular release

What PHP's informational advisory on CVE-2026-115560 says and leaves out: the conditions it names, the one-line setting it suggests, the missing versions, severity score and release date, and what The Register, The Hacker News and Cloudflare add.

Threat Intel23 Oct 2026

Node2Shell Brotli briefing withdrawn: it duplicated another briefing and named Node.js versions that do not exist

Why this Node.js Brotli briefing was withdrawn and where the account of CVE-2026-111497 is.

Threat Intel23 Oct 2026

Arista VeloCloud CVE-2026-114625: any authenticated user can gain operator rights; CISA lists it as exploited

What Arista's CVE record and CISA's catalogue state about CVE-2026-114625: affected and fixed releases, the minimum role, the two earlier exploited VeloCloud Orchestrator flaws, and what the record leaves out.

Threat Intel22 Oct 2026

Storm-0940 ARTEX briefing withdrawn: it duplicated another briefing and invented dates and notifications

Why this Storm-0940 briefing was withdrawn and where the corrected account is.

Threat Intel22 Oct 2026

UK government services briefing withdrawn: it joined two unrelated stories and carried unsupported detail

Why this UK government briefing was withdrawn, what the BBC and the NCSC say about the PHP shutdowns, and where the AI pilot figures come from.

Threat Intel22 Oct 2026

Mozilla says eight eMudhra intermediate CA private keys were below 256; Chrome and Firefox blocked them

What Mozilla, Google, Apple, CERT-In and eMudhra state about eight eMudhra intermediate CA keys below 256, what each has blocked, and what non-browser software must still update.

Conceptual visualization of encrypted telecommunications and acoustic surveillance showing active audio waveforms flowing across cybernetic processor circuits.

Threat Intel22 Oct 2026

Signal RingRTC zero-day flaw exposes ambient audio after hang-up

Technical analysis of Signal RingRTC CVE-2026-113380: FSM queue saturation, decoupling of UI dismissal from WebRTC audio hardware teardown, and the 2.72.0 fail-forward patch.

Threat Intel22 Oct 2026

INTERPOL says Operation Serengeti III led to 1,462 arrests and over USD 105 million recovered

What INTERPOL's release says about Operation Serengeti III: 1,462 arrests, 10,909 disrupted networks, more than USD 105 million recovered, the cases it names in Uganda, Angola, Nigeria, Tanzania and Gabon, and what it does not state.

Threat Intel22 Oct 2026

Kaspersky says Lazarus malware uses ML-KEM-1024 key exchange in Operation FlashHole against South Korea

What the Securelist report on Operation FlashHole says about ML-KEM-1024 in LPEClient, the infection chain, victims and indicators, checked against the report, the Kaspersky release and NIST FIPS 203.

Threat Intel22 Oct 2026

SafePay advisory AA26-293A briefing withdrawn: most of its figures and technical detail are not in the advisory

Why this SafePay briefing was withdrawn, and what the CISA and FBI advisory AA26-293A actually says.

A cinematic data center at night with rows of metallic server racks and illuminated green and cyan fiber optic status indicators on the right. The left half is darkened with overlay headline text describing the emergency PHP remote code execution fixes and a stat highlighting 22.6 million exposed hosts.

Threat Intel21 Oct 2026

PHP issues emergency fixes for two critical RCE flaws: CISA and UK NCSC issue urgent alerts

What PHP's advisory, the NCSC and CISA say about the PHP2Shell flaws: the four fixed releases, the stopgaps PHP prints, who is affected, and a corrected update checklist.

Editorial illustration of an unbranded server maintenance desk with empty update rows on two screens. The headline states that PHP has two critical security fixes, each rated 9.2 out of 10.

Threat Intel21 Oct 2026

PHP patches two critical RCE flaws: mod_php highest risk, FPM needs attention too

Two PHP 9.2 flaws can lead to unauthenticated code execution. The official advisories distinguish mod_php and FPM exploit evidence, fixed versions and interim controls.

Editorial illustration of an unbranded enterprise firewall and backup storage rack at night. The headline says SafePay, 600 victims and the two entry routes.

Threat Intel21 Oct 2026

SafePay: agencies count at least 600 victims, but the access route varies

The joint SafePay warning identifies at least 600 victims and two distinct access families. Here is how to test each exposure without treating the campaign as one fixed attack chain.

Editorial image of an unbranded laptop with a generic blank order receipt and a phone beside it. Text says a genuine sender can carry a planted phone lure, noting Talos's roughly 1,400-message sample.

Threat Intel21 Oct 2026

The order email passed authentication. The planted helpline was the attack

In Talos's samples, the sender passed checks while a fake support number appeared in shipping or billing fields. We trace that boundary, the 1,400-message denominator and two related notification routes.

Editorial illustration of network servers with a blue route diverted through a red intermediary node, representing reported SSH interception at Tor exit relays. Headline identifies 333 measured exits and 12 interception servers.

Threat Intel21 Oct 2026

333 Tor exits redirected SSH: the host-key warning was the decisive boundary

The 333 measured SSH redirects, the 377 policy matches, the Ebury case on one operator's servers and the exact point at which a host-key warning matters.

Editorial illustration of a cracked intermediate certificate in a chain, with a protective barrier before a browser window.

Threat Intel20 Oct 2026

Eight eMudhra CA keys were recoverable from tiny numbers. Firefox blocked them; 30,000 certificates may need migration

Mozilla found eight recoverable eMudhra intermediate keys. Firefox blocked them; root distrust now puts about 30,000 certificates into migration, according to eMudhra.

A dark engineering workstation at night. One monitor shows an installer-style window with blank list rows and a half-filled progress bar beside a folder window of identical blank file tiles, one tile outlined in amber and tilted. A desk lamp glows amber at the right edge. The headline and figure are added by the site.

Threat Intel20 Oct 2026

Siemens Software Center CVE-2026-110936: fix added 17 October, exploitation noted 19 October

What Siemens's advisory, blog and CVE records state about CVE-2026-110936, the four days before exploitation was noted, two scores, what Romulus is, what UK guidance reads, and a ranked defender checklist. Defender level only.

A dark room with a black server rack holding two brushed steel rack servers with blank recessed plates, and in front of it an open laptop on a black flight case. The laptop screen shows a list of five blank pale rows, the top three marked with amber dots and the bottom two with blue dots. The left half is empty dark blue, carrying the headline: five NGINX flaws, fixed 14 Oct, nginx.org rates all five medium, and the stat 3 of 5.

Threat Intel19 Oct 2026

Five NGINX flaws fixed 14 October: nginx.org says all medium, F5's CVSS 4.0 rates three critical

The labels on five NGINX flaws (nginx.org medium, F5 CVSS 4.0 critical for three), what each flaw needs, which press claims the records support, what the distribution trackers showed on 19 October, and the UK 5 day and 14 day clocks.

A small charcoal four-bay network storage box with blank drive-bay doors and one tiny blue standby light stands on a worn oak shelf in a dark room, a coil of plain grey network cable beside it. The left half is empty dark blue, with the headline and a stat drawn over it: fixed 4 August, exploitation seen 17 October, 74 days, as of 19 October.

Threat Intel19 Oct 2026

Plex2Shell: a honeypot saw exploitation 1 day after the write-up and 74 days after Plex's fix

What Plex's release notes, the CVE records, CISA and the two researchers' pages establish about Plex2Shell as of 19 October: the dates to scale, four scores that miss the chain, the build that is actually fixed, what UK guidance requires, and a ranked checklist. Defender level only.

A dark control room wall carrying a grid of about twelve columns of blank, softly backlit frosted tiles under empty rounded heading pills, with one tile outlined in indigo and two neighbours dimmer. The grid sits on the right; the left is empty dark blue carrying the headline and the stat 6 of 9 drawn over it.

Threat Intel19 Oct 2026

MITRE ATT&CK v20 adds 9 Enterprise techniques; in v20 neither prompt injection one has a detection strategy

A computed diff of MITRE's version 19.2 and 20.0 STIX data: nine new Enterprise entries, six detection strategies, SecurityWeek's claims checked, the water and Mexico campaigns against their cited sources, how NCSC pages use ATT&CK, and a ranked checklist.

A matte white home broadband router stands on an oak shelf in a dark hallway, with four faint cyan rings of light around it and one softly lit indicator. The left half is empty dark navy, carrying the headline Broadcom Wi-Fi setup flaw, no CVE on 19 October, and the stat 90 days.

Threat Intel19 Oct 2026

Broadcom WPS flaw: no CVE on 19 October, 90 days after the report; Broadcom cites a 2018 replacement

What the researcher's write-up, slides and project page state about the Broadcom WPS flaw, what Broadcom and the CVE records do not, the dated 90 days, and what the UK's PSTI regime, Telecoms Security Code and Cyber Essentials require and do not. Defender level only.

A dark data-centre aisle at night. A long row of identical black server cabinets with perforated doors recedes along the right of the frame, each door carrying a blank rounded label well. One door near the front stands slightly ajar and cold blue light spills out across the polished floor. The left half is empty dark navy, with the headline and a stat drawn over it: 3 of 7.

Threat Intel19 Oct 2026

PwnEscape (CVE-2026-99999): fixed upstream in 7 kernel series; Red Hat, Ubuntu, SUSE listed no fix on 19 October

What the CVE record, the kernel changelogs and each distributor's own page say is fixed and where, why one flaw carries 9.3 and 8.8, what is and is not established about exposure and exploitation, the UK guidance as read, and a ranked checklist. Defender level only.

A dark server hall in cool blue light. A row of identical black rack servers with perforated mesh fronts and small round status lights fills the right of the frame. On the middle server a strip of plain pale tape lies across the handle, blank. A slim console tray below it holds a small lit screen showing only an empty rounded pill and one block cursor. The left half is empty dark blue, with the headline and a stat drawn over it: 168+ days.

Threat Intel17 Oct 2026

Unit 42 says AI-generated code hit government Linux servers, but gives no count of victims, countries or scripts

What Unit 42's report on CL-UNK-1211 states and does not, the AI claim rung by rung, the labels that carry it, the planted red-team markers, what NCSC guidance and Cyber Essentials cover and where they stop, and a ranked checklist. Defender level only.

A dim server room in dark blue. A slim monitor on a dark desk shows a pale blank session window made of empty rounded slots, with no text or icons. Behind it, a dark equipment rack holds slim unmarked metal appliance panels and loose black cables. The left half is empty dark blue, with the headline and a stat drawn over it: 47 days from first known exploit to advisory.

Threat Intel17 Oct 2026

BeyondTrust Remote Support: first known exploit 29 August, advisory 47 days later, two victims stated

The dates behind the BeyondTrust Remote Support zero-day, what the record does not establish (victims, Privileged Remote Access, the patch), nine labels read against the primaries, four UK clocks, and ordered checklists for a service desk, an MSP and a CISO. Defender level only.

Conceptual law-enforcement evidence desk with closed laptop and folders

Threat Intel16 Oct 2026

INTERPOL reports 95 arrests across 17 countries in child-abuse material operations

The scope, investigative methods, safeguarding result and evidence limits behind INTERPOL's 15 October announcement.

Conceptual server-room illustration with a document icon on a rack display and a red line reaching it

Threat Intel16 Oct 2026

Nextcloud built-in CODE Server attacks: what CVE-2026-110447 exposed and who needs to act

A source-led breakdown of CVE-2026-110447, observed webshell activity, the affected built-in CODE Server mode and practical incident-response checks.

Illustrative desktop contrasting a verified source archive with a warned install script; all on-screen file names are fictional.

Threat Intel16 Oct 2026

Fake Arch AUR helper hid a root-level install script behind genuine yay source code

How the fake yyay package used a valid source archive as cover, what the .install script changed, what is confirmed about removal, and practical checks for Arch users.

Illustration of a laptop login screen beside an office network access point; no actual Windows configuration is shown.

Threat Intel16 Oct 2026

Windows October update changes NTLMv1-derived SSO default: check MS-CHAPv2 Wi-Fi and VPN before users lose access

A precise before-and-after comparison, affected versions, NTLM event IDs 4024 and 4025, a scoped temporary exception and the migration path for Wi-Fi, Ethernet and VPN.

Illustrative photograph of network edge devices in a home office; no victim device is shown.

Threat Intel16 Oct 2026

GreyNoise finds 143 proxyjacked edge devices; a separate intrusion shows why residential IPs complicate detection

The skynox7 proxyjacking campaign, affected device classes and CVEs, the separate Entra ID investigation, observed TTPs and defender checks.

Conceptual dark server rack and gateway representing a remote support appliance; no real BeyondTrust system is shown.

Threat Intel16 Oct 2026

BeyondTrust Remote Support zero-day: the patch is urgent, but the appliance may not tell the whole story

What happened, which Remote Support versions need BT26-05-RS, the observed SAWFLY and BARECLAW tradecraft, and where defenders should look when on-device logs have been erased.

Infoblox-published example of a fraudulent Microsoft-themed support warning over a browser, with a fake support number. This is a scam example, not a real Microsoft alert.

Threat Intel15 Oct 2026

Infoblox links 20,000 Cloudflare Pages domains to Help TDS; a browser scare becomes a remote-access lure

Help TDS and Hotejka: what Infoblox observed, what 20,000 domains cannot count, and practical controls against fake support and remote-access scams.

AI-generated editorial illustration of a green NGINX gateway in a server room with a metal protective panel being fitted.

Threat Intel15 Oct 2026

NGINX fixes five flaws in 1.30.6 and 1.31.7; configuration determines exposure

NGINX 1.30.6 and 1.31.7 patch five issues. A CVE-by-CVE table, version ranges and practical checks for HTTP/3, TLS tickets, rewrites and AIO.

A dark desk with a closed plain silver laptop at the back right, a ring of brass keys with blank round bows in front of it, and a fan of blank white hotel-style key cards, one card stood up on the key ring. The left half is empty dark blue, with the headline and a stat drawn over it: 9 PRODUCTS.

Threat Intel15 Oct 2026

Symantec names 9 AI products in Aoki infostealer's targets; victims, sample dates and delivery are not stated

What Symantec's report establishes about Aoki and AI assistant credentials, what it leaves out, the dated record, vendor statements on storage, lifetime and revocation, what UK guidance covers, and ordered checklists. Defender level only.

A matte graphite laptop and a plain black smartphone on a dark desk in a night office, each showing a page of empty grey bars with one bright rectangular advertising slot holding a blank panel and an amber empty button. Behind them a row of identical dark monitors recedes. The left half is empty dark blue, with the headline and a stat drawn over it: at least 45.

Threat Intel15 Oct 2026

AdFection: Citizen Lab says ads helped Candiru target at least 45 Al Jazeera devices, no infection count

What Citizen Lab's AdFection report and Confiant's post establish, what they leave out, why the 45 devices and the 441,954,291 impressions cannot be divided, what the ad platforms said, what UK guidance covers and where it stops, and three ordered checklists. Defender level only.

A dark equipment room with a black server rack on the right and its mesh door swung open. Six identical grey servers carry blank pill-shaped nameplate wells, and a pull-out console shows a dim admin screen made only of empty rows and one indigo button. The left half is empty dark blue, with the headline: a critical Drupal flaw, its team said exploits might come in hours or days, and the figure 28.5%, of reporting sites, affected branch, no fix.

Threat Intel15 Oct 2026

Drupal's critical Field UI flaw has no fix for 28.5% of reporting sites; its team said exploits may take hours or days

What the Drupal Security Team's advisory and release notes state and do not state about CVE-2026-108097, the arithmetic behind 28.5 per cent, the May exploitation precedent, UK controls and where they stop, and a ranked checklist for three kinds of owner. Defender level only.

A dark equipment room. In a black rack, a flat unmarked network appliance with a row of empty sockets has one grey cable plugged into its left socket, and a small blank paper tag tied to the cable. The left half is empty dark blue, with the headline and a stat drawn over it: 561 to 590 days.

Threat Intel15 Oct 2026

Unit 42 dates its FortiGate implant case to September 2024; the flaw behind the implant was published in April 2026

What Unit 42's PEERSTITCH report states and leaves out, the fix dates for four Fortinet flaws, why patching the FortiManager does not return stolen keys, what the NCSC, Cyber Essentials and the ICO say, and a ranked checklist. Defender level only.

A dark server room, the left half empty dark blue with the headline and a stat drawn over it: 3 DAYS. On the right a flat grey rack-mount firewall appliance in a black rack, its faceplate unmarked, with a small separate two-jack panel at one end lit by a single cyan light. A plain blank off-white access card lies on the shelf below it.

Threat Intel15 Oct 2026

PAN-OS CVE-2026-0322: CISA gave 3 days, and Palo Alto gives no count for 'very limited' exploitation

What Palo Alto's advisory, CISA's entry and the NCSC's pages establish about CVE-2026-0322: a 3-day window against Cyber Essentials' 14, which PAN-OS builds are fixed, ten open questions, UK controls and an ordered checklist. Defender level only.

A dark spare room. On a plain steel wall shelf stand eight identical closed silver laptops, each with a tiny cyan status light on the shelf's front edge, above a bare desk with a black power strip and an empty black office chair. The left half is empty dark blue, with the headline and a stat drawn over it: 40+ Texas residences searched, 14 charged in Ohio, overlap not stated, and $3M.

Threat Intel14 Oct 2026

Over 40 Texas residences searched, 14 charged in Ohio, and no stated overlap between the two DOJ actions

What the DOJ releases and the 58-page indictment state about the 40-plus Texas residences, the 14 charged, the $3 million and the 70-plus companies, where five news stories count differently, what UK law asks of an employer hiring remote developers, and an ordered checklist.

A dark server rack in cold blue light. A glass-fronted rack stands open on the right with plain grey servers, and one server tray is slid forward. In it sits a smaller matte black box with a hairline crack across its lid that runs out over the grey floor of the tray, with a thin cyan light along the line. The left half is empty dark blue, with the headline and a stat drawn over it: 2 OF 5.

Threat Intel14 Oct 2026

Vghost: kernel fix dated 3 August, demos 12 October, and 2 of 5 tested distributions still without a fix

What the kernel commit, the CVE record and the vendor trackers establish about Vghost, what found by AI does and does not say, how seven raters score it from 6.4 to 8.8, which of 26 releases have a fix, the UK clocks and a ranked checklist. Defender level only.

A dark equipment cabinet in cool light. A large brass screw-threaded coupling with a visible thread and a backed-off nut hangs in a dense sweep of cables in cyan, blue, white, grey, red and amber that all run into it. Blank recessed plates sit on unmarked rack units behind. The left half is empty dark blue, with the headline and a stat drawn over it: 616 days.

Threat Intel14 Oct 2026

curl's first High flaw in 1,099 days was in 13 releases; curl lists eight conditions for code execution

The arithmetic behind curl's High flaw, what its advisory states and leaves out, where libcurl hides, what the distributions had fixed on 14 October, the UK patch clocks as read, and a ranked checklist. Defender level only.

A plain black rack-mounted network appliance with two blank pill-shaped recesses on its bezel takes in a line of five blank cream envelopes on a steel roller conveyor. The envelope nearest the viewer carries one blank red wax seal. The left half is empty dark blue, with the headline and a stat drawn over it: 30 days.

Threat Intel14 Oct 2026

Cisco's second exploited email gateway flaw in 30 days: its two fixed builds were named on 14 September

What Cisco's 14 October advisory for CVE-2026-76519 states and leaves out, the two conditions and the scanner update that fixes it, the 16.0 gap, what Shadowserver's count can and cannot say, what NCSC, Cyber Essentials and the ICO say as read, and an ordered checklist. Defender level only.

A dark print shop. On the right, four taut cords hold rows of identical pale paper sheets, each printed with the same blank page layout of empty rounded bars and boxes and no writing. One sheet in the front row has been ripped away, leaving a ragged strip in two wooden pegs and a crumpled scrap on the floor. The left half is empty dark blue, with the headline and a stat drawn over it: 34 names.

Threat Intel14 Oct 2026

Microsoft's temporary order moves 34 names under five domains; its billion messages are not a victim count

What Microsoft's announcement, its sworn declarations and the court order actually count: 34 names moved, a billion messages with no stated method, 1.1 million dollars traced against tens of millions claimed, and what UK organisations should do.

A dark small-shop back room. A row of plain white and grey boxes with blank label wells sits on a shelf above a counter holding a switched-off terminal screen on a stand and a pale grey card reader, with a dark server tower at the far right. The left of the frame is empty dark blue, with the headline and a stat drawn over it: 177 listed.

Threat Intel14 Oct 2026

Adobe's October bulletins list 177 flaws; every one rated critical sits in AEM, ColdFusion or Commerce

What Adobe's 11 bulletin pages establish and do not, why 176 is 177 entries and 175 ids, how priority 2 and 3 compare with the Cyber Essentials and NCSC clocks, the Commerce hotfix beside a no exploits line, and a ranked checklist. Defender level only.

A dark desk after hours. On the right, three tall stacks of grey bound ledgers with blank label plates stand beside a closed silver laptop, and a cream folder with one red paper clip lies on the laptop. The left is empty dark navy with the headline and stat drawn over it: seven totals for one release, one exploited CVE, 7 TOTALS.

Threat Intel14 Oct 2026

Microsoft's October Patch Tuesday has seven totals, 1,407 to 1,417, and one exploited CVE, not three zero-days

Which rule produces each outlet's total and Critical count, what zero-day did and did not mean, what Microsoft states about the exploited Windows Shell bug, why its risk cohorts omit it, and the UK clocks and an ordered checklist, and September's release set beside it.

A dark desk in cold blue light. An unmarked pale grey desktop document scanner holds a stack of blank white sheets in its input tray and feeds one blank sheet out of the front. Behind it a flat monitor shows a grid of twelve blank page thumbnails, one outlined in cyan. The left half is empty dark blue, with the headline and a stat drawn over it: 0 of 10,240.

Threat Intel14 Oct 2026

Ghostscript CVE-2026-39919: two exploits failed 10,240 times on other builds and worked on the matching one

What Wordfence's post establishes about a Ghostscript PDF flaw, where BleepingComputer's wording departs from it, what 0 of 10,240 does and does not say, which distributions have a fix, the UK patching clocks, and a ranked checklist. Defender level only.

A dark equipment rack holding one plain grey rack-mounted network appliance, with a row of empty network jacks and a blank rounded plate on its faceplate, black blanking panels above and below, and a pale blue network cable hanging in a coil from a hook on the rack post. The left half is empty dark blue, with the headline and a stat drawn over it: Fully patched, still exploited, 2 of 3.

Threat Intel13 Oct 2026

A fully patched Ivanti VPN gave an attacker root through a three-flaw chain; two flaws are fixed, one is not

What Ivanti, Volexity, NVD and CISA each state about the Connect Secure chain, the fixed builds and their dates, what the record does not establish, the UK clocks and duties, and an ordered checklist. Defender level only.

A dark corporate server room in cool blue light. On the right stands a tall black rack of enterprise servers whose faceplates carry blank pill-shaped recesses, with grey cables down its side. In front of it a stainless steel service cart carries a flat monitor showing an empty form made only of blank rounded fields and an empty button. The left half is dark and carries the headline, SAP's 10.0 flaw sits in a library you must upgrade yourself, and the stat 53 days.

Threat Intel13 Oct 2026

SAP's October 10.0 is a library customers must upgrade, with a fixed build dated 53 days before the advisory

What SAP's 13 October overview and GitHub advisory state about the 10.0 OAuth2 SSRF in the Cloud SDK for Python, the 22 rows counted, who acts on each Critical row, the UK clocks to 27 October and an ordered checklist. Defender level only.

A dark data-centre aisle in cool blue light. A black rack on the right is filled with network switches whose faceplates carry empty port openings and blank pill-shaped recesses, with bundles of grey and teal patch cables falling in loops. One small amber port light glows on one switch. The left half is dark and empty and carries the headline, Cisco's October bundle, 16 of 35 CVEs score 9.0 or more, and the stat 20 of 35.

Threat Intel13 Oct 2026

Cisco's October bundle: 16 of 35 CVEs score 9.0 or more, 7 in NX-OS, and 20 are umbrella IDs with no bug count

What Cisco's 14 advisories state and do not: the count by product and score, what a 'hardening release' is, five critical NX-OS flaws gated by features, fixed releases per train, the UK 14-day clock to 21 October, and an ordered checklist. Defender level only.

A dark data centre aisle. On the right, a black server rack holds four matching pale grey rack servers above a row of blank black drives, with a flat black status panel at the top, switched off and blank, and one small amber light at its corner. More racks recede into the dark. The left half is empty dark blue, with the headline and a stat drawn over it: 32 DAYS.

Threat Intel13 Oct 2026

Progress published 31 MarkLogic flaws 32 days after the fixes shipped, and the August fixes miss them

What Progress's bulletin, release notes and CVE records establish about 31 MarkLogic flaws, what they leave out, the arithmetic behind 32 days, the Cyber Essentials clock, UK guidance and an ordered checklist. Defender level only.

A dark server room corner in cool blue light. A pale grey rack-mounted backup appliance with rows of blank black drive bays and a dark blank status display stands in an open black rack beside a tall graphite tape library whose smoked window shows shelves of plain black cartridges with empty pale label windows. The left half is empty dark blue, with the headline and a stat drawn over it: 9.4.

Threat Intel12 Oct 2026

Veeam CVE-2025-64393: a Backup Viewer can run code on the backup server, in version 12 only

What Veeam's advisories establish about the Backup Viewer flaw and the Cloud Connect file read, what they leave out, the fixed build for each version line, the evidence on exploitation, what UK guidance and Cyber Essentials say, and a ranked checklist. Defender level only.

A dark equipment room. A grey rack-mount server is pulled forward out of a black cabinet on the right, its status lights dark. A blank paper calendar page with one amber square is clipped to the cabinet rail beside it, and a blank card tag with an amber band hangs from the server handle. The left half is empty dark navy carrying the headline Struts mapper flaw: two of four lines are end of life, and the words No patch.

Threat Intel12 Oct 2026

Struts CVE-2026-104711: two of four affected lines are end of life; the remedy is a mapper change, not a patch

What Apache's bulletins, the CVE records and CISA's catalogue establish about CVE-2026-104711 and its three companions, the version-line matrix, the end-of-life dates, what they leave out, UK controls and a ranked checklist. Defender level only.

A dark help-desk desk at night. A white desk telephone with blank round keys and its handset in the cradle sits beside an open laptop whose screen shows an empty remote-session window with blank pills, and a black headset with a boom microphone lies in front. The left half is empty dark blue, with the headline and a stat drawn over it: 42 of 50 recent victims were law firms.

Threat Intel12 Oct 2026

Luna Moth leak: no new malware, a phone call and a remote tool, and Check Point treats the files as unverified

What Check Point's analysis of the Luna Moth Files establishes, what it leaves open, the arithmetic behind it, what the NCSC, Cyber Essentials v3.3 and the ICO say, and a ranked checklist for a group that steals data without encrypting it. Defender level only.

A dark server room. A tall black server rack with plain blank drive bays stands on the right beside a wall-mounted board of three rows of five empty rounded tiles joined by thin lines, like a pipeline. One tile in the middle row carries a single small lit amber lamp. The left half is empty dark blue, with the headline and a stat drawn over it: CVSS 10.0.

Threat Intel12 Oct 2026

GitLab says CVE-2026-97229 needs no account, the third regex-titled critical in 19 days

One CVSS metric separates 12 October's critical from the two regex criticals of 23 September: the attacker no longer needs an account. What GitLab states, what it leaves out, the count checked, CISA and the NVD at 14:52 BST, the UK 14 day clocks and an ordered checklist.

A dark server room. A black equipment rack holds six flat grey firewall appliances with blank label plates, and a single small cyan status light is lit on the third. Beside it a plain paper calendar page is taped to the rack, a grid of empty squares with one square outlined in cyan marker. The left half is empty dark blue, with the headline and a stat drawn over it: 149 days.

Threat Intel12 Oct 2026

Palo Alto's CVE-2026-0257 advisory was 149 days old when ReliaQuest warned ransomware groups still use it

A computed gap, 149 days, from Palo Alto's advisory to ReliaQuest's warning; the fixed versions per train; four scores for one flaw; what no source establishes; UK controls; and an ordered checklist. Defender level only.

A dark desk in low blue light with one open laptop on the right. Its screen is tiled with about three dozen small identical blank windows, each with a pale title bar and two grey bars, and the keys are blank. The left half is empty dark blue, with the headline and a stat drawn over it: 51 agent files, WordPress flaws fixed on 17 July, 32 shells.

Threat Intel12 Oct 2026

CyberXero: 51 Claude Code agent files, 32 shells in 61 seconds, and WordPress flaws fixed on 17 July

What SOCRadar's CyberXero report establishes, what it does not, the arithmetic behind 32 shells in 61 seconds and 564,073 of 628,000 records, the public fixes and CISA KEV status for the named CVEs, what the model's maker has said, UK controls, and a ranked checklist. Defender level only.

A dark designer's desk at night. A large monitor shows a half-built web page layout made only of blank rounded shapes, with a dark indigo side panel and a bright canvas. Beside it stands a small industrial warning lamp with a smoked amber dome, switched off. A white mouse and stylus lie on a grey felt mat. The left half is empty dark blue, with the headline and a stat drawn over it: 21:47 UTC.

Threat Intel12 Oct 2026

Bricksforge CVE-2026-85097: exploit attempts began on disclosure day; the changelog has no 3.1.8.10 date

What the primary records establish about CVE-2026-85097: the first attempt, a fix date nobody publishes, three flaws in five weeks on one database's dates, a spray of 56 requests from 44 addresses, UK controls and an ordered checklist. Defender level only.

A dark room with an open paper desk diary on a walnut desk at the right of the picture. Its pages hold seven empty ruled boxes with blank pills at the top, and one amber sticky note lies in a box on the right page. The left is empty dark, with the headline and a stat drawn over it: 0 clicks.

Threat Intel11 Oct 2026

Calendar phishing arrives with zero clicks on Google Workspace's default; Sublime's 33,000% is a projection

What Google's and Microsoft's own pages say about the default, which settings stop a calendar lure and which do not, the number behind "exponential", what no source establishes, UK reach of the NCSC and Cyber Essentials, and a ranked checklist. No lure is printed.

A dusk landscape. A pale grey outdoor steel cabinet stands in the right foreground with its door swung open and a brass padlock hanging open from the hasp, an empty blank plate on the door. The base of a white wind turbine tower rises behind it and rows of solar panels recede to an amber horizon. The left half is empty dark blue, with the headline and a stat drawn over it: 93% solar.

Threat Intel11 Oct 2026

Modat counts 8,547 wind and solar systems reachable online: 93% solar, a floor, and the UK outside its scope

What Modat's pages, Reuters and others establish about 8,547 exposed wind and solar systems, the arithmetic behind the percentages, why the UK is outside the count, what the NIS Regulations and the NCSC say, and a ranked checklist. Nothing identifying a site is printed.

A dark room with two near-identical brass nameplates side by side on a walnut desk at the right of the picture. Each has four screws and an empty recessed panel. The right plate is slightly darker and redder, with a small dimple at each end of its panel. The left is empty dark, with the headline and a stat drawn over it: 29 letters.

Threat Intel10 Oct 2026

Two characters put 20 lookalike domains past Chromium's checks: a 29-letter list and an 8,462-domain list

What the researchers' write-up and Chromium's own source establish about two characters that pass the browser's lookalike checks, what is not stated, why a list fails open for a letter or a brand it does not hold, UK controls and a ranked checklist. No lookalike domain is printed.

A dark desk at night with a black smartphone lying face up at the centre right. Its screen shows an update page made only of empty pills: one short title pill, three wide grey pills and a blank pale cyan button. Beside it stand a small closed steel padlock and, behind it, a blank white card. The left is empty dark, with the headline and a stat drawn over it: 239 days.

Threat Intel10 Oct 2026

P7 DarkSword is a kit for iOS 18.4 to 18.7, and Apple fixed all six of its flaws by 11 February 2026

What iVerify, Google, Lookout, Censys, Report URI and Apple establish about P7 DarkSword: the six flaws and their fixes, which iPhones are exposed, what is not stated, UK controls and a ranked checklist. No indicators are printed.

A dark room with a silver laptop on a walnut desk at the right of the picture. Its screen shows a download page made only of empty pills, a browser strip, and a pale cyan button above a blank command panel with an empty copy square. Beside it stands a blank white card and a blank amber sticky note lies on the desk. The left is empty dark, with the headline and a stat drawn over it: 4 stops.

Threat Intel10 Oct 2026

A Google ad showed bing.com; four stops later a fake Claude installer's copy button swapped the command

What Push Security and BleepingComputer establish about the Adception campaign: the four stops, the cloaking gates, the swapped clipboard command, what is not stated, UK controls for Macs and a ranked checklist. No attacker addresses are printed.

A dark room with a slim black monitor on a walnut desk at the right of the picture. Its screen shows one window outlined in pale cyan, made only of empty pills and blank rounded squares, with a small cyan pill at the top right. Beside it stands a compact black tower computer with a mesh front and one amber status light. The left is empty dark, with the headline and a stat drawn over it: 107 days.

Threat Intel9 Oct 2026

AnyDesk Linux: the researchers' root exploit came 107 days after a release logged only as a crash fix

What AnyDesk's changelogs, its post on X, the researchers' post, NVD, CVE.org and CISA's catalogue establish about the AnyDesk Linux flaw: dates, scope, the relay dispute, the UK timescales and a ranked checklist.

A dark pinboard covered in rows of pinned paper index cards, nearly all turned face-down and blank, with a few turned face-up to show blank white faces with empty grey bars. Text on the left reads: 2,627 ransomware claims, 247 confirmed by victims. 9.4% of Q3's claims are confirmed by the victim (247 of 2,627, derived).

Threat Intel9 Oct 2026

Q3's record 2,627 ransomware attacks: 247 confirmed by the victim, 2,380 only claimed

Recounting Comparitech's Q3 2026 ransomware record from its own tables: 247 of 2,627 confirmed, a Q2 that was a dip, 517 of the 597 extra claims from strains with no Q2 claims, and two other trackers that agree on direction and not size.

A dark server room: a black rack holds one graphite backup storage server with a grid of identical drive bays and an amber light, and a graphite monitor on a steel desk shows a console of blank rounded rows. Text on the left reads: Ahsay said 10.3.4 fixed it. A day later: not fully. 3 days 16 hours: NVD record to Huntress's first sighting (derived).

Threat Intel9 Oct 2026

Huntress said AhsayCBS 10.3.4 was affected; Ahsay said it fixed both flaws, then said it did not fully

A computed gap, one build that two vendors described in opposite ways until the vendor changed its answer, and a backup console that MSPs expose to clients. What the record, Huntress and Ahsay state, what is not stated, UK clocks for MSPs and the order of actions.

A dark equipment room: a black rack holds three identical graphite network appliances, each with one amber light, and below them a graphite laptop on a steel cart shows a blank sign-in screen of rounded empty fields. Text on the left reads: The previous NetScaler fix build is affected, for SAML IdPs. 3 in 11 days: NetScaler bulletins on 27 Sep, 3 Oct and 8 Oct.

Threat Intel9 Oct 2026

Citrix's third NetScaler bulletin in 11 days lists the previous fix build as affected, for SAML identity providers

Three NetScaler bulletins in 11 days, ten CVEs, and a new SAML flaw whose affected range ends at the previous fix build. What Citrix states and leaves out, the UK patching clocks and what to check.

An empty newsroom desk at dusk with an open laptop showing an article page made of blank shapes, a blank press-pass lanyard, a printed page proof with one highlighted byline slot and a row of wooden blocks stepping upward, two of them amber. No people. Overlaid text reads: Two of 30 rated Category 5 and 4, no outlet named in the text, 5 of 6.

Threat Intel9 Oct 2026

Two of OpenAI's 30 exposed influence operations rate Category 5 and 4; its text names no outlet that ran them

OpenAI says it banned two influence operations that used ChatGPT and rates their reach Category 5 and 4 of 6. What the page states and omits, how Anthropic's reports compare, and what UK publishers and security teams can check.

A dark room with a graphite laptop on a walnut desk at the right. Its screen shows one empty bar above a grid of eight empty tiles, two of them filled amber. In front of it lies a clear evidence bag holding a small router and a round camera, with a blank label strip. Beside it is a stapled sheaf of pages with grey bars for text and an amber tab. The left of the picture is empty dark, with the headline and a stat drawn over it: 2 of 8+.

Threat Intel9 Oct 2026

Integrity Tech seizure: of at least eight scanned targets, the affidavit alleges breaches at two universities

What the 8 October seizure papers, the 58-page joint advisory and the NCSC's own item establish: two alleged breaches, six scan targets not said to be breached, 20 universities or six, and a UK checklist.

A dim security operations desk with a graphite laptop open in front of a black server rack holding three plain servers. The laptop screen shows a log search view of blank rounded rows, three of five outlined in amber and the first opened out. Text on the left reads: Only one of Splunk's three Critical CVEs says how it works. 1 of 3, Critical CVEs with a stated precondition and mitigation.

Threat Intel8 Oct 2026

Splunk's three Critical Enterprise CVEs: one is explained, two are only a weakness class and a score

Of 83 CVEs in Splunk's five 7 October advisories, three Splunk Enterprise flaws score 9.0 or more. One is explained. Two are a weakness class and a score, and the October affected ranges end at August's fix builds.

A dark room with a graphite laptop on a walnut desk at the right. Its screen shows a map of connected empty circles, three filled cyan and one amber, with a column of empty pills at the left and three empty cards at the right. A tablet on a stand beside it shows a pale card with one empty field and a cyan button, and a phone in front shows three empty rows. The left of the picture is empty dark, with the headline and a stat drawn over it: 1 footnote.

Threat Intel8 Oct 2026

CrowdStrike's ARTEX report: AI use rests on the actor's own files, the bank breaches on one press footnote

What CrowdStrike's 7 October post establishes and what it leaves out: AI tooling from the actor's files, no named bank, no victim count, no Anthropic model named, a stack 3 to 63 days old, and a UK checklist.

A dark room with a graphite laptop on a walnut desk at the right. Its screen shows a pale card of empty grey pills with a cyan button. A phone lies face up in front with a small card of two empty pills, and behind the laptop a paper poster with an amber header bar and grey lines is pinned to a felt board. The left of the picture is empty dark, with the headline and a stat drawn over it: three emails.

Threat Intel8 Oct 2026

Talos's 'AI-assisted' label rests on three emails; the Google relay behind them forwards the codes people type

What Talos's 8 October post on UAT-11985 establishes and what it leaves out: three emails behind the AI-assisted label, a relay that forwards typed codes and taps, no victim count, and what UK organisations on Google can do.

A dark room with a graphite laptop on a walnut desk at the right. Its screen shows a generic browser window with an empty address bar above a long, tightly packed list of rows, each a small coloured pill and a grey bar with no writing: four coral rows at the top, then amber rows, then cyan and slate ones, the list running off the bottom of the screen.

Threat Intel7 Oct 2026

Chrome 155's 247 fixes: 14 credits name an AI tool, all reported 6 to 12 days before release

What the 14 AI credits establish and do not, SecurityWeek's figures checked against the notes, how 247 compares with earlier Chrome releases, the bounty column, and a UK checklist.

A dim equipment-room steel bench with a graphite rack-mount network appliance cabled to an open laptop. The laptop screen shows a list of blank rounded rows with one row outlined in amber. Text on the left reads: September's SMA1000 fix build is the newest build listed affected, 35 days, 1 Sep fix build to the 6 Oct advisory that lists it as affected.

Threat Intel7 Oct 2026

SonicWall's September SMA1000 fix is the newest build its 6 October advisory lists as affected

The build that fixed September's exploited SMA1000 flaws is still affected by the 6 October 10.0 flaw. Both earlier advisories that reported exploitation reached CISA's catalogue within a day, and this one is not listed in the version read, which predates it.

A black rack server on a steel shelf in a dark cupboard with a plain red cloth book lying on top of it, and below it a laptop on a crate showing an empty list of blank rows with one hollow slot.

Threat Intel7 Oct 2026

PoeLLM hides its address in a poem, but the LiteLLM flaw Lumen names was fixed 177 days before its report

Lumen's report on the PoeLLM botnet gives its victim count as more than 3,400 in one place and almost 2,200 in two others. The poem hides a command address; the doors are exposed AI services and a LiteLLM flaw that had a fix for 177 days.

A dark server room with a tall black rack of five blank rackmount servers on the right and, in front of it, a laptop on a low steel cart whose screen shows a terminal window of thirteen empty grey lines with one small empty amber key outline in the top corner, to suggest a remote login with nothing filled in.

Threat Intel7 Oct 2026

OpenSSH 10.6's notes cite no CVEs, yet MITRE issued 11 within 12 hours; none is for the post-quantum key

What the 10.6 notes state about AI-found reports and release cadence, the 11 CVE records and who scored them, the ML-DSA signature versus key exchange, Debian, Ubuntu and Red Hat status, and a UK checklist in the order worth doing.

A small agency desk in low light with an open laptop showing a plugin list drawn as blank rounded rows, one row outlined in amber with a small update-arrow outline, and a fan of plain colour swatches beside it. There is no lettering and nobody in the room.

Threat Intel7 Oct 2026

Ninja Forms was fixed 14 days before Patchstack saw the first attack, and the fix does not clean a hacked site

Patchstack recorded the first attempt on Ninja Forms CVE-2026-94504 on 5 October, 14 days after the 3.15.4 fix. The campaign leaves four ways back in, only one visible in the dashboard, and two figures in circulation, 600,000 and 3,600, belong to other things.

A dark network closet at night. On the right an open equipment rack holds one flat rack-mounted firewall appliance with a row of empty ports, and below it an open laptop on a black road case shows a list of nine blank rounded rows, one outlined in amber, with a small empty padlock outline in the corner.

Threat Intel7 Oct 2026

FBI's FortiBleed alert names no CVE, and its 86,644 is SOCRadar's count, which stood at 30,791 on 17 June

FBI and USSS advisory JCSA-20261006-01: no CVE, a count credited to SOCRadar (30,791 on 17 June, 86,644 a day later), lockouts and ransomware reporting without numbers. What it does not establish, the UK position, and a checklist.

A laptop on a marketing desk showing a blank browser window with a second, smaller blank window laid over it, and a sign-in form drawn as empty rounded pills with one teal button. A fan of plain colour swatches lies in front and a felt board of blank colour squares stands behind. Nothing carries any lettering.

Threat Intel6 Oct 2026

Fake ad portals for six AI brands span 189 days; a drawn Google window relays passwords and MFA codes

The window is drawn, the address bar is copied and a typed code is relayed live. Island reports hundreds of submissions, but states no victim count, loss, operator or UK reach.

A smartphone lying on a dark desk, its screen showing a blank sign-in page drawn as empty rounded pills, with a cyan outline of a key and a small empty padlock. Nothing carries any lettering of its own.

Threat Intel6 Oct 2026

Passkeys urged after a 417% rise in reported losses that Report Fraud's own assessment links to its new service

Reports rose 34 per cent but victims reporting a loss rose 10.3 times, and no document says how the accounts were taken. A passkey closes one door; recovery and fallback sign-in are others.

Editorial illustration for the briefing: LibreOffice's fix for a spreadsheet code-execution flaw came 73 days before its advisory; OpenOffice has none

Threat Intel6 Oct 2026

LibreOffice's fix for a spreadsheet code-execution flaw came 73 days before its advisory; OpenOffice has none

The LibreOffice fix shipped on 24 July and the advisory on 5 October. OpenOffice still has no released fix and a public proof of concept has existed since 5 October. What each project documents, and what to do first.

Threat Intel6 Oct 2026

Seven of Atlassian's 19 fixed builds for CVE-2026-21589 are on lines that leave support by 30 December

Eight Atlassian Data Center products, 19 fixed builds, a 9.3 that computes to 8.7 without its downstream assumptions, and a CVE record whose Crowd and Bamboo builds disagree with the bulletin. What the sources state, and what they do not.

A free-standing cash machine at night in a dark shopfront, seen from a low three-quarter angle: its screen lit with blank rounded pills and the large hinged service panel on its upper cabinet shut and locked with a small round lock. The left side of the picture is empty darkness carrying the headline.

Threat Intel5 Oct 2026

$40.73M over 1,500+ ATM attacks is at most about $27,000 each, and the charged route starts at the cabinet door

Divide Treasury's headline loss by its own attack count and the average is at most about $27,000. The DOJ, FBI and ATM makers all put the real control at the cabinet door, the keys, the alarm response and the disk, not at the arrest.

A dark corridor with a wall-mounted digital signage display showing only blank empty panels, a small black PC box fixed to the wall beside it, and a laptop on a trolley showing a task list of six empty rows, one outlined in amber.

Threat Intel5 Oct 2026

A Samsung signage flaw at least 476 days old led to AnyDesk on try three and a miner built on the host

At least 476 days between the CVE record and the incident, three AnyDesk download attempts, eight days between two reports on one endpoint. What Huntress states, what it does not, and the order of checks for signage servers.

A small router and a small CCTV recorder on a bare shelf in a cupboard, with a laptop in front showing an empty list of blank rows and one hollow slot.

Threat Intel5 Oct 2026

Cling botnet poses as STUN traffic, but gets in through flaws catalogued up to 4,175 days ago

A Linux botnet dresses its command traffic as STUN, the NAT-traversal protocol behind video calls, but it gets in through flaws first recorded between 2015 and 2026. The disguise is the news; the doors are the part a UK security lead can still control.

Threat Intel5 Oct 2026

Dell posted the DSU fix 65 days before it called the flaw critical, and the download says Optional

The lead flaw is scored Network with no privileges, so it is not a local escalation by Dell's own scoring, but all five need user interaction Dell never explains. One fix, no workaround, nothing on exploitation.

Editorial illustration for the briefing: Android 17's accessibility lock works only if the user turns Advanced Protection on; no uptake figure found

Threat Intel5 Oct 2026

Android 17's accessibility lock works only if the user turns Advanced Protection on; no uptake figure found

Google's accessibility restriction needs three things at once: Android 17, Advanced Protection switched on, and an app that is not a verified accessibility tool. Only the first has a published figure, and it is a third party's estimate.

A rack of three servers in a dark equipment room with an engineer's laptop on a flight case in front of it, the laptop screen showing a table of blank request and response slots with two rows outlined in amber.

Threat Intel5 Oct 2026

Cache key injection has a 2020 name, four 2026 lab demonstrations, no CVE and no named victim

A research technique, not an exploited flaw: what the write-up states, how Kettle's 2020 paper named the same bug class, what five vendors' documents say about how keys are joined, and a UK checklist for cached personalised pages.

A racked server in a dark equipment room with a laptop on a steel trolley in front of it, the laptop showing a mailbox list of blank rows with one row picked out in a thin amber outline. A network cable runs from the server to the laptop.

Threat Intel5 Oct 2026

Microsoft shipped September's Exchange update twice, 24 days apart, and only the second fixes CVE-2026-96940

The first September update is listed as affected, one of nine CVEs is rated Exploitation More Likely, and the cloud fix has no date. What the record states, what it leaves out, and a UK checklist.

A racked network appliance in a dark equipment room, with an engineer's laptop on a case in front of it showing a status board of blank tiles, one drawn as a hollow amber outline to suggest a service that has dropped out.

Threat Intel4 Oct 2026

CISA lists a third exploited NetScaler flaw seven days after two others, and Citrix calls it denial of service

A third NetScaler flaw in seven days, scored 8.7 against 9.5 for the first two. What the record states, what it leaves out, why denial of service is not the mild category on a gateway, and where the word patched stops being true.

A dark finance desk at night. A wide monitor shows a payment approval page made only of blank rounded shapes, with one solid indigo button. In the foreground a small plain USB hardware token sits plugged into an unmarked aluminium hub on a walnut desk.

Threat Intel4 Oct 2026

SConnect was fixed in the app stores 55 days before its CVE, but the desktop host is a separate install

The SConnect token middleware was fixed in the browser stores on 7 August and given a CVE on 1 October. SWIFT's notice says the extension updates itself but the desktop host does not. CISA's coordinator recorded no exploitation on 2 October.

Editorial illustration for the briefing: Fortra's BoKS 9.9 advisory names no fixed version, and the update does not secure passwords already generated

Threat Intel4 Oct 2026

Fortra's BoKS 9.9 advisory names no fixed version, and the update does not secure passwords already generated

The advisory page for BoKS CVE-2026-79901 names no affected version and no fix. The CVE record names both, says the update leaves existing AD service-account passwords unsafe, and gives no 8.1 fix. What is stated, what is not, and what UK teams should do.

A server rack holding a plain one-unit network appliance with a blank front panel, and in front of it a laptop showing a process list made of empty pills, with one identical pair outlined in teal.

Threat Intel4 Oct 2026

Linux implants copy mail appliance names and port 25 traffic. Rapid7's 12 hashes do not say how they got in

Rapid7's 2 October report lists 12 hashes for Linux implants that imitate Korean and Taiwanese mail security appliances, with a payload file that exists for ten seconds. Entry route, victims, first-seen dates and UK exposure are not stated.

Threat Intel4 Oct 2026

At least seven victim actions, no named vulnerability: CloudSyncD launches on a typed password

A fake Zoom disk image runs its backdoor on a password the victim types. Jamf names no vulnerability, victim, actor or delivery route, and never saw the cloudsyncd daemon in use.

Threat Intel3 Oct 2026

Microsoft's median weaponisation time, 'well below 24 hours', comes with no sample, period or source

The headline speed claim cannot be checked from the report. Its other pages give 5.3 hours, single-digit days, about five days and 30 to 60 days for other clocks, and CISA's catalogue gives a median of 3 days for new flaws, 1 day lately.

Threat Intel3 Oct 2026

CVE-2026-61500 was fixed on 13 July. Exploitation was reported 80 days later, within 39 hours of a write-up

The fix is 80 days old, six CVEs shipped with it, CISA's catalogue does not list the flaw, and the exploitation evidence is one firm's sensors. What the record establishes, what it leaves open, and what UK teams running HFS should do.

A dark desk at night with an open laptop whose screen shows a mailbox drawn as blank rounded rows, one outlined in cyan, beside a grid of six blank file tiles, with a closed plain grey document folder lying in front of it.

Threat Intel3 Oct 2026

Antino polls an Outlook mailbox every 10 seconds, over Microsoft hostnames enterprises commonly allow

By Talos’s intervals one Antino implant makes about 10,080 Graph requests a day, to hostnames enterprises commonly allow. What the report states, what it leaves out, and which controls fit a channel whose mailbox the actor owns.

Threat Intel3 Oct 2026

Symantec says Warlock attacked a water utility and a telecom, and names no 2026 SharePoint flaw

Warlock's latest victims include a water utility and a telecom provider. The report names only the 2025 ToolShell flaws, so a build number and a hunt for stolen machine keys matter more than any CVE list.

Threat Intel3 Oct 2026

Dell's CSM advisory has two 10.0 flaws among 13. The 'root on nodes' one is a 9.9 needing low privileges

The two 10.0 flaws are unauthenticated and sit in CSM Authorization, the proxy that holds the array credentials. Root on nodes is a different 9.9 in the operator. Dell names one fix, 1.18.0, and says nothing on exploitation.

Threat Intel3 Oct 2026

FortiMail's exploited flaw has no fixed build in any of four branches, and CISA's deadline is 4 October

No FortiMail build named in the advisory's four branches is fixed on the page as read on 3 October. Fortinet's own records disagree on which builds are affected, and the advisory page lost its file indicators without a revision note.

Threat Intel1 Oct 2026

Fake AI committee, borrowed names: all three sender addresses Proofpoint lists are consumer webmail

All three attacker sender addresses in Proofpoint's July list are consumer webmail. A reading of its 1 October report on TA419: what it states, what it leaves out, why MFA and DMARC miss the chain, and an ordered checklist for UK organisations.

Threat Intel1 Oct 2026

MI5 names one Chinese funder and over 100 UK-linked academics, but no university, project or case

The alert is one page and about 470 words. It asserts the funding chain at both ends, says nothing about what UK work gave China's MSS, and asks institutions to establish a funder that NPSA's own collaboration checklist never asks about.

Threat Intel1 Oct 2026

Sucuri says the SC WordPress backdoor lives in at least eight places. Its own report names eleven

Eight files, a database row, a shared-memory segment and scheduled tasks: eleven places in Sucuri's own account of a WordPress backdoor that returns within seconds. What the report states, what it leaves out, and the order to clear it.

A laptop on a desk at dusk shows two identical software installer prompts stacked one behind the other, with a blank cream invitation card propped against a mug beside it.

Threat Intel1 Oct 2026

A genuine, signed MSP360 installer, disguised as invites and updates, installed a second remote tool

One signed MSP360 installer, five example filenames, a second remote tool, and 60 to 90 days between Microsoft's July sightings and its post. The signer was real; whether you approved it is the control.

Threat Intel1 Oct 2026

TeamViewer's five patched flaws: one scored remote, four local, none known exploited

Five flaws, one fixed build, zero days between release and bulletin. A client updated in August is still listed as affected, and for UK organisations the Cyber Essentials 14-day clock on these fixes ends on 13 October.

A racked network appliance in a dark equipment room, with an investigator's laptop in front of it showing a list of blank rows, one of them drawn as a faint dotted amber outline to suggest a hidden file.

Threat Intel1 Oct 2026

LevelBlue adds a fourth NetScaler web shell disguise. Citrix says an update is not a cleanup

Six vendor reports describe four disguises for a NetScaler web shell, and LevelBlue's is the newest. What it states, what it leaves out, why one vendor's file names will not find another's, and what an update does not do.

Editorial illustration for the briefing: Entra ID will refuse injected scripts from mid-October, and Microsoft names one impact test: a browser console

Threat Intel1 Oct 2026

Entra ID will refuse injected scripts from mid-October, and Microsoft names one impact test: a browser console

From mid-October 2026 the Entra sign-in page will run only Microsoft scripts. Users can still sign in, so a failing tool raises no outage, and Microsoft describes no tenant report. The policy also guards one page only.

Threat Intel1 Oct 2026

CoreGraphics flaw: a public crash test 46 hours after Apple's CVE record, and no proof of a WhatsApp route

A public CoreGraphics crash test is not proof of exploitation, and the WhatsApp path rests on a line the researchers removed. CISA had already moved to active a day earlier. What UK teams should do about iPhones and Macs.

Threat Intel30 Sept 2026

Zimbra's CVE ID came 24 days after the patch. Microsoft's earliest dated probing is day 8

The dates, the score and the versions checked against Zimbra, NVD, CISA and Microsoft. What a patch does not remove from a hit mail server, the one victim count that exists, and a defender checklist.

Threat Intel30 Sept 2026

A new MikroTik RouterOS flaw is not the exploited one, and CISA changed its fix version from 7.23 to 7.24

CVE-2026-84411 is new, scored 9.8 and not reported exploited. CISA now names 7.24 as the fix, above the newest long-term build 7.23.7, and MikroTik has published no advisory.

Threat Intel30 Sept 2026

Cisco dates the SD-WAN Manager attacks only as 'September', and omits five trains its May table listed

CISA set a federal deadline of Saturday 3 October. What Cisco states and does not, the fix table set against its May one, four names for one flaw, what the UK record says, and a defender checklist.

Threat Intel30 Sept 2026

543,699 working credentials in public GitHub code: at least 63% predate default push protection

What the Truffle Security count establishes, what its dates probably mean, and the gap it names itself: GitHub can block some secrets at push time, but only the issuer can make a leaked key stop working.

Editorial illustration for the briefing: Nine of 13 Star Blizzard campaigns are event invitations, and the invitation usually has no attachment

Threat Intel30 Sept 2026

Nine of 13 Star Blizzard campaigns are event invitations, and the invitation usually has no attachment

A count of Microsoft's own timeline, an invitation with nothing to scan, and six labels that reassure without controlling anything: what the RedFlick report establishes about Star Blizzard, and what it leaves open.

Threat Intel30 Sept 2026

Spectre BTR: a Linux root hash in 3 to 5 minutes on two Intel chips, with the kernel fix public since July

VUSec and Sant'Anna's Branch Target Reuse attack read a root hash at 8 bytes per second on two Intel chips. Stale predictor entries were reusable on AMD and Arm too, but nothing leaked there. The kernel fix dates from July.

Editorial illustration for the briefing: Citrix NetScaler was exploited at least 22 days before the patch. The three-day federal clock ends today

Threat Intel30 Sept 2026

Citrix NetScaler was exploited at least 22 days before the patch. The three-day federal clock ends today

Mandiant, eSentire and GreyNoise now date NetScaler exploitation to before the 27 September bulletin. What Mandiant observed and what it did not, how the exploited pair compares with briefing 143, and what to hunt and harden.

Threat Intel30 Sept 2026

OpenSSL's DTLS leak is scored 8.2 by CISA and 7.4 by Red Hat, and the gap is what OpenSSL did not say

A DTLS retransmission bug can send OpenSSL heap memory to the other side or crash the process. Fixes are public for four branches, premium-only for three and absent for 3.1 to 3.3. No exploitation is reported and no leak size is stated.

Editorial illustration for the briefing: Two of at least 40 ClickFix incidents came through a custom GPT, and the chatgpt.com address proved nothing

Threat Intel30 Sept 2026

Two of at least 40 ClickFix incidents came through a custom GPT, and the chatgpt.com address proved nothing

A confirmed share of at most 5 per cent, four comforting labels and one command the person ran themselves: what Huntress's 28 September report establishes about custom GPTs used as ClickFix lures, and what it leaves open.

Editorial illustration for the briefing: One 29-word Apple sentence names iOS twice and macOS never, yet it sits on all three CoreGraphics advisories

Threat Intel29 Sept 2026

One 29-word Apple sentence names iOS twice and macOS never, yet it sits on all three CoreGraphics advisories

Apple's exploitation notice for CVE-2026-86950 is one 29-word sentence about iOS, repeated on both macOS advisories. Older iOS and macOS lines have no listed fix, and Lockdown Mode cannot be set by MDM.

Threat Intel28 Sept 2026

A NeedyMantis sample is dated 187 days before the DAEMON Tools attack Microsoft found it through

Microsoft's earliest dated NeedyMantis sample was first seen on 3 October 2025, 187 days before DAEMON Tools installers were trojanised. The malware hard-codes a Firefox 21 user agent, a browser released in May 2013.

Threat Intel28 Sept 2026

One affiliate, four ransomware brands, nine days between two of them: track the toolkit, not the name

Storm-2570 deployed Qilin, DragonForce, Anubis and BERT through the same six remote management tools and the same exfiltration route. The brand on the ransom note is the part that changes.

Threat Intel28 Sept 2026

852 of 1,235 Meta ads led to 17 toll fraud apps, and Google's takedown did not stop the billing server

A store takedown is a distribution control, not remediation. CERT Polska's toll fraud analysis shows the billing server outliving the Google Play removal, and why a UK premium rate bar may not cover the route this operation used.

Threat Intel28 Sept 2026

The WAF rule blocked one spelling of the path. ShinyHunters used another, 107 days after Oracle's patch

A rule that matches the text of a path is a control on one spelling of an endpoint, not on the endpoint. The attackers read the published guidance and aimed at the organisations that followed half of it.

Editorial illustration for the briefing: Citrix fixed eight NetScaler flaws in one bulletin. The federal three-day clock covers two, and neither is the highest scored

Threat Intel28 Sept 2026

Citrix fixed eight NetScaler flaws in one bulletin. The three-day federal clock covers two, and neither is the highest scored on NVD's scale

KEV is a list of what is exploited, not a ranking of what is worst, and a three-day deadline makes it very easy to forget that. The Citrix bulletin of 27 September is a clean example of the difference.

Editorial illustration for the briefing: CISA's weekly vulnerability bulletin ends today. The largest section of the final edition has no severity at all

Threat Intel28 Sept 2026

CISA's weekly vulnerability bulletin ends today. The largest section of the final edition has no severity at all

CISA is not retiring the bulletin because it failed. It is retiring a faithful record of a model that stopped working, and the final edition shows exactly where it stopped.

Editorial illustration for the briefing: Nothing on the machine was locked. Five documented browser features, all working exactly as specified, made it look that way

Threat Intel26 Sept 2026

Nothing on the machine was locked. Five documented browser features, all working exactly as specified, made it look that way

There is no malware in this chain and nothing on the computer is affected. The product being manufactured is panic, and the delivery is ordinary paid advertising through uncompromised publishers.

Threat Intel26 Sept 2026

The marketplace listed 321,372 products to 18,000 users. In nine years it made 7,600 sales and $232,000

A listing is not a sale and a registered account is not a customer. The Rydox court record contains both measures, and the gap between them is the story that the word marketplace hides.

Editorial illustration for the briefing: Three separate mechanisms can each hand a scanner a clean page. A single automated fetch meets all three

Threat Intel26 Sept 2026

Three separate mechanisms can each hand a scanner a clean page. A single automated fetch meets all three

A clean result from an automated check is not an observation about the site. It is a decision the operator made about the checker, and this chain makes that decision at three independent points.

Threat Intel26 Sept 2026

Every link in this chain is a legitimate paid service. The only malicious artefact is a configuration

The impersonated products do not exist: none of the three payroll platforms ships a desktop app. Allure Security counted 291 downloads and said plainly that some of them were researchers.

Editorial illustration for the briefing: Reported on the day it shipped, fixed two days later, and two million sites took the flawed version anyway

Threat Intel26 Sept 2026

Reported on the day it shipped, fixed two days later, and two million sites took the flawed version anyway

Nobody in this story was slow. The flaw is a CSRF check that skips validation whenever a literal string appears anywhere in the request URI, and the query string is written by whoever composes the link.

Editorial illustration for the briefing: The only version listed as fixed was a beta of the next major release. The branch everyone runs got nothing

Threat Intel26 Sept 2026

The only version listed as fixed was a beta of the next major release. The branch everyone runs got nothing

What eventually forced the backport was a ransomware gang's leak site being defaced. Grav shipped a 1.7 fix the day after the details became public, 144 days after the advisory.

Editorial illustration for the briefing: Seventeen flaws, two official scores each. Six cross a severity band, and every one of them crosses upward

Threat Intel26 Sept 2026

Seventeen flaws, two official scores each. Six cross a severity band, and every one of them crosses upward

The flaw that gains the most, 8.1 to 9.2, is a firmware verification weakness on a dashcam with no fix, from a vendor that has not responded to CISA. A robot vacuum is filed under Information Technology.

Threat Intel26 Sept 2026

The catalogue calls it path traversal. Its own CWE, and both sources it cites, say authentication bypass

The structured data is right and the prose is wrong, which is the failure mode of every hand-written label sitting beside machine-readable fields. A team triaging by name goes hunting for the wrong thing.

Threat Intel26 Sept 2026

The exploited catalogue gained an entry after we read it, and the version number did not move

Anything that caches on the version saw no change. The third entry is a WordPress Core remote file inclusion flagged for forensic triage, and a day later the trade press was still reporting two.

Threat Intel26 Sept 2026

Canada says this flaw is being exploited. CISA's own machine-readable record, three days later, says none

Two allied national cyber bodies, one CVE, three days apart, opposite conclusions. Neither is reading a sensor. Both are reasoning over the same thin public record, which is the part worth understanding.

Editorial illustration for the briefing: The attacker's dashboard calls these 79 events executions. The researchers who found it refuse the word

Threat Intel25 Sept 2026

The attacker's dashboard calls these 79 events executions. The researchers who found it refuse the word

A fake verification page that verifies nothing, measured by a panel that counts interface progress and labels it execution. The gap between an event and the thing it is named after is the entire story.

Editorial illustration for the briefing: Of seven controls in this spyware's console, one does exactly what its label says, and it only answers pong

Threat Intel25 Sept 2026

Of seven controls in this spyware's console, one does exactly what its label says, and it only answers pong

Two controls are not implemented at all, one is a stub that reports success without reading anything, and the self destruct does not uninstall or undo the damage. Your own device management console is read exactly the same way.

Editorial illustration for the briefing: Cisco gave customers a compromise hunting command 47 days before the same advisory said the flaw was exploited

Threat Intel25 Sept 2026

Cisco gave customers a compromise hunting command 47 days before the same advisory said the flaw was exploited

An indicator of compromise is a retrospective artefact. Publishing one says compromise is possible and checkable. Every tool that triages on the exploitation field saw nothing for 47 days.

Editorial illustration for the briefing: Two vendors published three days apart. The malware shares a LaunchAgent, a repair script and a utility name

Threat Intel25 Sept 2026

Two vendors published three days apart. The malware shares a LaunchAgent, a repair script and a utility name

Neither vendor says they are the same thing, and a shared builder sold as a service would explain it too. Either way, a defender reading one report and not the other is missing half the indicators.

Threat Intel25 Sept 2026

The TeamCity entry did not change on Wednesday. One field did, and it is the one your tooling drops

Shadowserver counts about 160 exposed TeamCity servers still unpatched, down from roughly 700. The remaining ones hold build credentials and sign artefacts.

Threat Intel25 Sept 2026

Both of today's additions to the exploited catalogue were public for weeks. The deadline is three days

September now stands at 38 additions to the catalogue, 30 of them on a three day clock. The clock starts when CISA notices, not when the flaw became dangerous.

Threat Intel25 Sept 2026

Roundcube fixed eight flaws in one release and named none of them. The exploited one was line three

Roundcube has eleven entries in the CISA exploited catalogue, more than any other webmail. This one is not among them, four days after a national cyber centre warned about it.

Editorial illustration for the briefing: Windows reports the path of every file touched on the machine, and Microsoft calls it an undocumented feature

Threat Intel25 Sept 2026

Windows reports the path of every file touched on the machine, and Microsoft calls it an undocumented feature

A watch on the root of C: reports filesystem events across every user, with filenames, regardless of permissions. That was enough to identify which of the top 1,000 sites another user was visiting, with an F1 score of 97.8 per cent.

Threat Intel25 Sept 2026

Two CISA advisories, 17 CVEs each scored twice, and the number at the top of both pages is the lower one

Both advisories put a v3 score in their summary table. One of them headlines 8.8 high while the page below it contains a 9.2 critical.

Threat Intel25 Sept 2026

The KEV entry says path traversal. Its own CWE, and both sources it cites, say JWT signature bypass

A defender triaging by the catalogue's own words would hunt for a file upload path. The flaw hands over an administrator session to anyone who signs a token with an algorithm the server never supported.

Threat Intel24 Sept 2026

CISA added 34 flaws to the exploited catalogue in September, and 26 came with a three day deadline

September is the busiest month of 2026 in the Known Exploited Vulnerabilities catalogue, at 1.48 additions a day against a yearly mean of 0.89. The deadline never varies with how hard the change is.

Threat Intel24 Sept 2026

The password spray failed. Seven accounts fell, and not one of them belonged to a person

Six of the seven fell inside seven minutes, which is not guessing. It is one provisioning default, used repeatedly, on accounts nobody had looked at in years.

Threat Intel24 Sept 2026

MikroTik withheld the details for a day. The patch had already published them

CERT Polska has published the full MikroTrick chain. The interesting part is not the bug. It is how little time withholding the details actually bought anyone.

Editorial illustration for the briefing: A documentation placeholder nobody reserved now serves a ClickFix lure, and the request is the detection

Threat Intel24 Sept 2026

A documentation placeholder nobody reserved now serves a ClickFix lure, and the request is the detection

Reserved names exist so copied example code cannot reach a live host. Somebody used a real domain instead. Every outbound request to it is now both an exposure and, usefully, a near zero false positive detection.

Editorial illustration for the briefing: CVE-2026-87902 is being exploited, there is finally something to search for, and one timestamp moved six hours

Threat Intel24 Sept 2026

CVE-2026-87902 is being exploited, there is finally something to search for, and one timestamp moved six hours

Yesterday the advisory gave defenders nothing to search for. Today there are request, response and file indicators, all of them from two firms selling protection. The vendor, the CISA KEV catalogue and the NVD record still say nothing happened.

Threat Intel24 Sept 2026

Entra never sends the password to an external MFA provider. A rogue one can simply ask again

The TrustSink technique does not extract passwords from Entra. It asks users for them a second time, on a full page a third party draws inside a trusted sign-in, and Entra validates only the token that comes back.

Threat Intel24 Sept 2026

A Defender update block with no CVE, and a health report that reads green for seven days

Microsoft says it typically publishes definitions three times a day, and its device health report treats a signature build as current for seven days. A blocked machine can therefore sit about twenty releases behind and still read as protected.

Threat Intel24 Sept 2026

GitLab's issue by email address is a credential, and GitLab presents it as an address

The token inside a GitLab issue by email address does not expire, covers every project the account can reach, and is exempt from IP restrictions. Seven properties, six documentation pages, and one copy button.

Threat Intel23 Sept 2026

A fake Claude Max giveaway harvests Google logins: the pretext is new, the phishing is not

The only precise figure the fake Claude Max giveaway publishes is 92.5 per cent of slots gone, and it is generated in the visitor's browser. What the research does not establish matters more than what it does.

Threat Intel23 Sept 2026

WordPress patched every branch twice in five days: 7.1.2 fixes an include flaw scored 9.2 and 8.1

The second WordPress core security release in five days fixes an unauthenticated path traversal that selects a PHP file to run, not to read. Two preconditions must hold, and the hardening constant that mattered last week does nothing here.

Threat Intel23 Sept 2026

Four KEV entries, one 61 day gap: Check Point's management server was attacked in July, fixed in September

Two of the four new KEV entries name Check Point, but only one is the management server. The take that fixes the other is the top of the vulnerable range for it. What the four advisories do not state matters more than what they do.

Threat Intel22 Sept 2026

Four of CISA's nine new ICS advisories are about borrowed code, and the lwIP fixes have no release

Nine ICS advisories, six of them republished Siemens notices, one flaw already on the known exploited list since May, and two fixes that no vendor can simply install. A prioritisation guide for UK OT owners.

Threat Intel22 Sept 2026

D-Link DIR-822A scored 10.0 with a public exploit, and D-Link still cannot say if a fix is coming

D-Link has acknowledged two critical DIR-822A flaws with public exploit code, but the bulletin confirms no hardware revision, no lifecycle status and no firmware fix. The UK PSTI regime would not have helped the owners either.

Threat Intel22 Sept 2026

An ARM64 KVM escape sat in shipping kernels for 348 days, but only nested hosts are exposed

A guest to host escape in Linux KVM on ARM64 reached shipping kernels on 28 September 2025 and was fixed in stable on 11 September 2026. Who is exposed comes down to one boot parameter.

Editorial illustration for the briefing: SharePoint CVE-2026-65660 went from spoofing to code execution 16 days after release, filed as informational

Threat Intel22 Sept 2026

SharePoint CVE-2026-65660 went from spoofing to code execution 16 days after release, filed as informational

Microsoft relabelled CVE-2026-65660 from spoofing (6.5) to remote code execution (8.8) 16 days after release. The fix was always in the August updates; the risk is teams that sorted by the first label.

Editorial illustration for the briefing: Every VeloCloud Orchestrator release that fixed July's exploited flaw falls inside the new CVSS 10.0 bug's range

Threat Intel22 Sept 2026

Every VeloCloud Orchestrator release that fixed July's exploited flaw falls inside the new CVSS 10.0 bug's range

A second exploited CVSS 10.0 flaw in on-premises VeloCloud Orchestrator in 57 days. Here is how to tell if you are exposed, the patch path by release train, and what Arista says to look for in your logs.

Threat Intel22 Sept 2026

A Microsoft-signed driver kills 145 security tools, and Microsoft's own blocklist did not stop it

Alinubx.sys carries a 2023 Microsoft hardware signature, kills 145 AV and EDR processes, and was not on Microsoft's vulnerable driver blocklist at publication. What the blocklist, HVCI and the ASR rule do and do not cover.

A closed laptop and a paper comment card on a desk beside a brass padlock and a sealed envelope, lit by a desk lamp

Threat Intel22 Sept 2026

WordPress fixed Comment2Shell in 25 releases on one day; check yours is one of them, and that no plugin arrived first

WordPress core shipped 25 security releases on 17 September for a comment XSS that can reach an administrator's session. What to confirm, which wp-config setting actually blocks plugin upload, and why updating does not remove a plugin already added.

Editorial illustration for the briefing: Defender can report protected while its updates stall: how to prove signatures are current across an estate

Threat Intel22 Sept 2026

Defender can report protected while its updates stall: how to prove signatures are current across an estate

BigDiskBuster, released on 19 to 20 September 2026, keeps Defender on whatever signatures it already has. Microsoft's own reports can call a device up to date for seven days. Here is how to measure currency, not status.

Editorial illustration for the briefing: Only the Zyxel switch flaw is in CISA's KEV; the Veeam agent exploitation claim rests on one vendor headline

Threat Intel22 Sept 2026

Only the Zyxel switch flaw is in CISA's KEV; the Veeam agent exploitation claim rests on one vendor headline

CVE-2026-7273 in Zyxel GS1900 switches entered KEV on 21 September with a 24 September deadline after GreyNoise documented data theft from 996 switches. CVE-2026-32996 in Veeam Agent for Windows has a public PoC but no KEV entry.

Threat Intel22 Sept 2026

Talos's CLOSEDQUORUM lets four LLMs vote on an implant's next move, but the only public build is inert

CLOSEDQUORUM asks DeepSeek, Qwen, Mistral and Gemini which of four attack actions to take, then acts on the plurality. Talos found placeholder keys, no confirmed victims and a narrower first than the headline suggests.

Threat Intel21 Sept 2026

A Windows privilege fix that held 28 days: Project Zero on dangling COM registrations

A COM class that points at a DLL that does not exist is not harmless. Project Zero shows how a dangling registration in a writable path becomes SYSTEM, and how to audit your estate for the same pattern.

Editorial illustration for the briefing: Fake interviews target Rust maintainers' publishing rights, and arrayref showed what one stolen account does

Threat Intel21 Sept 2026

Fake interviews target Rust maintainers' publishing rights, and arrayref showed what one stolen account does

Rust maintainers are being lured onto video calls to install a fake audio codec or paste a command. The arrayref release of 20 August, downloaded 2,285 times in 86 minutes, shows why their accounts are the prize.

Threat Intel21 Sept 2026

ChainScript's operator moved its C2 twice for a quarter of a cent, and the blockchain logged both moves

ChainScript turns a pasted Win+R command into a per-user MSI, a hidden Node.js agent and a C2 address stored on the Polygon blockchain. Here is the chain step by step, why the pointer survives takedown, and the controls that still work.

Editorial illustration for the briefing: North Korea's TraderTraitor put macOS backdoors on an Indian IT provider, and the delivery was never proven

Threat Intel21 Sept 2026

North Korea's TraderTraitor put macOS backdoors on an Indian IT provider, and the delivery was never proven

The same two Jade Sleet backdoors that helped take 292 million dollars from KelpDAO turned up on an Indian IT provider with no crypto ties. What the vendor established, what it did not, and what UK firms that outsource to Indian MSPs should ask this week.

Threat Intel21 Sept 2026

Google's mole inside TeamPCP saw 500,000 stolen credentials and a gang that could barely cash them

TeamPCP stole more than 500,000 credentials but, by Google's estimate, made only tens of thousands of dollars. What an undercover analyst saw, what rests only on one researcher's account, and what UK engineering teams should change.

Threat Intel21 Sept 2026

TASK#STOMP: a PowerShell backdoor hiding in native Windows tools that already log it

TASK#STOMP relies almost entirely on wscript, PowerShell, Task Scheduler and the .NET compiler, so it leaves no conventional executable to catch. It also leaves a script block log, a task creation event and an AMSI scan behind at every step. The report does not name a victim, sector or attacker.

Editorial illustration for the briefing: PAYLOAD ransomware hit a whole Windows domain through two Group Policy objects and no endpoint malware

Threat Intel21 Sept 2026

PAYLOAD ransomware hit a whole Windows domain through two Group Policy objects and no endpoint malware

Two GPOs, six settings, no Windows malware: how PAYLOAD used Group Policy for domain-wide extortion, what Kaspersky could not establish, and the Microsoft audit events that would have seen it.

A smartphone sits on a mobile forensics bench with a hidden debugging connection extending beyond the app.

Threat Intel20 Sept 2026

RatHat pairs with its own Android Debug Bridge. Uninstalling the APK can leave the shell behind

A step-by-step analysis of RatHat's Accessibility abuse, local ADB self-pairing, native persistence, credential theft and defensive controls.

An engineer compares three conflicting software component manifests beside a dependency graph.

Threat Intel20 Sept 2026

Three SBOM tools scanned the same projects and disagreed. CRA compliance cannot be a generator checkbox

The new SBOM study quantifies tool disagreement and shows what manufacturers should validate before the Cyber Resilience Act applies in full.

Two hostile server clusters exchange warning signals across a dark network as one leak portal is overtaken.

Threat Intel20 Sept 2026

ShinyHunters defaced Clop’s leak site. The page proves write access, not stolen onion keys

The Clop defacement is confirmed at the presentation layer. The evidence does not yet establish server root, victim-data access or control of the onion identity.

Threat Intel19 Sept 2026

Fake interviews exploited at least 30,000 PCs in eight months, and the wallets were the cheap part

A joint advisory of 18 September 2026 puts at least 30,000 exploited PCs and over 7,000 drained cryptocurrency wallets behind a fake recruitment campaign. The arithmetic says the access, not the crypto, was the product. No UK victim is named.

Threat Intel19 Sept 2026

GitHub removed the fake LastPass repositories. Four of the six Rapuncel domains still resolve

Fake GitHub organisations impersonating LastPass Authenticator ranked in search and delivered an infostealer behind a Microsoft signed driver that terminates 145 security products. The repositories are gone. Most of the delivery chain is not.

Threat Intel19 Sept 2026

A leaver's OAuth token copied about 170 CrowdSec private repositories, and the audit log never saw it

About 170 private CrowdSec repositories were cloned in nine minutes and four seconds on 22 May 2026, using the account of a developer who had just left. GitHub's own documentation explains why the organisation audit log was empty.

Threat Intel19 Sept 2026

WordPress Click2Shell: the forced theme install still needs an administrator to open the link

The forced theme install is real, the chain to code execution is real, and both run on an administrator's session. Here is what WordPress fixed, in which versions, and what its own release notes do not say.

Threat Intel19 Sept 2026

CISA's three Linux kernel KEV entries and the four public root exploits are seven different flaws

Three Linux kernel CVEs entered CISA's KEV catalogue on 18 September 2026 and four others got public local root exploits the same day. No CVE appears on both lists, and the patch state differs sharply between them.

Threat Intel19 Sept 2026

Conductor's 9.8 was patched 27 days before it had a CVE, and CISA's exploited list still has no entry

CVE-2026-58138 lets anyone who can reach an unpatched Conductor server run operating system commands on it. The open-source build has no authentication to bypass, and the orchestrator holds credentials for everything it orchestrates.

Editorial illustration for the briefing: WeaselBiscuit ran on import, not install, so ignore-scripts would not have stopped any of the 17 npm packages

Threat Intel18 Sept 2026

WeaselBiscuit ran on import, not install, so ignore-scripts would not have stopped any of the 17 npm packages

WeaselBiscuit executed on import rather than install, so the standard ignore-scripts control sat at the wrong gate. Every package is now gone from npm, median takedown under 13 hours. Here is what it could actually reach.

Threat Intel18 Sept 2026

Unauthenticated root on a Check Point management server, triggered by an over-long username at login

CVE-2026-91843 lets an unauthenticated attacker run code as root on Check Point Security Management, Multi-Domain and Log Servers. The advisory names eleven affected version bands and offers four packages. No exploitation is reported and one indicator is published.

A tall stack of printed listings with a red tab and a long printout spilling off a desk beside a calendar and a laptop.

Threat Intel17 Sept 2026

CISA ends its weekly vulnerability bulletin, a CVSS-sorted digest that never flagged exploitation

CISA retires its weekly Vulnerability Bulletin on 28 September. We parsed 70 issues: it was a CVSS-sorted copy of CVE records, with no exploitation signal, long gaps and a "Not Yet Assigned" table that hid CVSS 10.0 exploited flaws.

A brass seal stamp and a broken red wax seal on papers beside a laptop and a key on a dark desk.

Threat Intel17 Sept 2026

KREMLIN forges Chrome's integrity check to load an extension the user never approved

KREMLIN copies an extension into Chrome and Edge, enables developer mode and regenerates the Secure Preferences integrity MACs so the browser loads it as approved. It changes what an ExtensionSettings allowlist can and cannot promise.

A phone standing in a charging rack of devices, with a SIM card and another phone, below a wall calendar marked in red.

Threat Intel17 Sept 2026

Exploited Pixel modem flaw is rated High, not Critical, and Google has not said who was targeted

The Pixel modem zero-day is real and fixed at patch level 2026-09-05. The record names no targets, no attacker and no chain, and CISA's CVSS score moved from 8.0 to 8.8 within a day with nothing new from Google.

A grey network appliance, a lanyard ID badge, an hourglass and a laptop on a steel shelf beside a dimly lit server aisle.

Threat Intel17 Sept 2026

Cisco ISE needs no login, the Acronis cPanel flaw needs a foothold: one KEV deadline, two different risks

An unauthenticated root path into Cisco ISE and a local privilege escalation in Acronis's cPanel backup plugin entered KEV together. What each attacker needs first, what fixes it, and what the three-day clock means in the UK.

A rack-mounted mail appliance pulled out of its rack in a data centre aisle, its amber beacon lit and envelopes spilling across the floor.

Threat Intel17 Sept 2026

Cisco's exploited email gateway flaw: three days to patch, and patching starts the investigation

CVE-2026-76461 lets a crafted email run root commands on Cisco Secure Email Gateway. The KEV deadline is today. The upgrade closes the hole; it does not tell you whether the gateway, and the credentials it holds, were already taken.

A kitchen table at night used as a desk: an open personal laptop with a dark screen lit by a single warm lamp, a phone face up beside it, and at the far edge in cold light a closed corporate laptop in a sleeve with a coiled security cable and a lanyard.

Threat Intel16 Sept 2026

When the managed device holds, this spyware asks for the personal one

Read from the joint advisory in full. A unique Telegram bot per victim removes the pivot defenders rely on, and the escalation to personal devices lands outside every control on the asset register.

An intelligence analysis room linking public photographs to broad map probability rings, human review and a simulated drone.

Threat Intel14 Sept 2026

Anthropic's models can geolocate a photograph and write simulated drone guidance. The missing number is human uplift

A careful reading of Anthropic's targeting and conventional-weapons evaluations, including the 37 km geolocation result, simulated strike rates, limitations and practical controls.

AI-generated editorial scene of an invoice awaiting approval beside a laptop and desk telephone in a finance office at night.

Threat Intel13 Sept 2026

Microsoft traced more than 1 million executive-impersonation emails. The payment control still failed off-screen.

Microsoft details a million-message executive impersonation campaign built around fake invoices and payment requests.

AI-generated editorial photograph of an unbranded VPN gateway, certificate card and key in a dark network operations room.

Threat Intel13 Sept 2026

Check Point patches two VPN flaws that can enable unauthenticated RCE. It reports no exploitation.

Check Point has remediated two critical VPN-related flaws and says it has no indication of active exploitation.

AI-generated editorial photograph of an unbranded firewall management appliance with an open panel and red warning light.

Threat Intel13 Sept 2026

Cisco confirms exploitation of CVE-2026-20079. An FMC web request can lead to root.

Cisco confirms active exploitation of a critical Secure FMC authentication bypass that can provide root access.

AI-generated security editorial scene of a protected document escaping from a locked repository archive drawer.

Threat Intel13 Sept 2026

GitLab fixes a CVSS 10 file-read flaw. Internet probes appeared one day later.

GitLab’s critical patch closes an unauthenticated arbitrary-file-read route in the repository commits API.

$AI-generated threat-intelligence still life of three fractured security layers surrounded by four evidence cases.$

Threat Intel13 Sept 2026

BlueMoon chains 3 zero-days across Chrome and Windows. Four espionage groups adopted it in days.

Four espionage groups adopted BlueMoon, a shared chain joining two Chrome V8 vulnerabilities with a Windows kernel elevation flaw.

Threat Intel9 Sept 2026

Two Tanium report permissions can become code execution. Three release branches need checking.

Comply has two distinct access paths in these advisories. The fixed module versions matter more than a platform-level update checkbox.

An empty out-of-hours IT operations desk during a night maintenance window: two dark switched-off monitors, a keyboard pushed askew, a mug of tea with a spoon, a clipboard holding a printed checklist with lines ticked in biro, headphones and a notepad, lit by a single desk lamp, with a server rack of amber and green standby lights visible through a glass partition behind.

Threat Intel8 Sept 2026

Two perfect scores in this Patch Tuesday need no action. The two being exploited score 7.8.

Read from Microsoft's own CVRF. Nothing is publicly disclosed, the 1,170 figure is a month's accumulation, and the field to check is Customer Action Required.

A small online retailer's despatch bench at night after closing: three sealed plain cardboard parcels stacked under a caged work lamp, a small thermal label printer with a curl of blank labels spilling onto the bench, a black card payment terminal with a dark screen, a roll of packing tape and scissors, with racking of plain stock cartons receding into shadow behind.

Threat Intel8 Sept 2026

Adobe told Commerce merchants to rotate their payment gateway keys. The coverage stopped at the patch.

Read from Adobe's own bulletin, the NVD record and CISA's catalogue. A fully patched store was still taken, and the catalogue has not moved since Friday.

A small unbranded network router with external aerials on a steel bench at night, its lid removed to expose a green circuit board, yellow and blue patch leads looping from its ports, an amber status light lit, with a blurred terminal display behind it.

Threat Intel7 Sept 2026

A national CERT found six RouterOS flaws with a cyber model, and wrote down exactly what the model did not do

MikroTrick, the indicators of compromise, and the methodology section almost nobody quoted. The vendor's own detection marker does not prove a device is clean, and CERT Polska say so.

An unbranded rack-mounted network appliance pulled half out of a dark server rack on its slide rails, network cables hanging loose beneath it, lit by a hard torch beam from the right.

Threat Intel7 Sept 2026

SonicWall's exploited SMA 1000 flaws need four remediation steps, and almost everyone reported one

Vendor-confirmed exploitation, a KEV deadline that expired on Saturday, and a remediation procedure that assumes you may already be compromised.

A grid of dark stained wooden library card catalogue drawers photographed at a raking angle, each with a tarnished brass label frame catching the light. Every label frame is empty.

Threat Intel5 Sept 2026

Cisco found these with frontier AI models, grouped them into seven umbrella CVEs, and never said how many bugs there are

The most consequential sentence in the IOS XR advisory is the one about how the flaws were found, and almost every write-up removed it. What follows from it is a counting problem.

A pair of heavy brushed-steel doors standing almost closed in a dark concrete room, with a narrow vertical sliver of hard white light spilling through the gap and laying a thin bright wedge across the floor.

Threat Intel5 Sept 2026

The KEV remediation window fell from 21 days to three, and the 60-day tier everyone quotes has never existed

A directive reported as reducing the patching burden coincides with the most aggressive tier becoming the default on three quarters of new entries. Two opposite errors are circulating about it.

A single deep crimson wax seal, freshly pressed and glossy, on a sheet of near-black paper, lit by a cold white rim light from the right. The seal is smooth and unstamped, carrying no crest, monogram or mark of any kind.

Threat Intel3 Sept 2026

A BGP hijack delivered a malicious Virtualizor update, and the TLS certificate on it was genuine

AS62390 announced a Hetzner /24 for 33 hours, diverting Softaculous update traffic. Let's Encrypt issued a valid certificate because its own domain validation was routed through the hijack.

A single small blank white index card lying on a vast matte charcoal surface, lit by a cold rim light from the right, the left half of the frame falling away into near-black. The card is entirely unprinted.

Threat Intel3 Sept 2026

The whole public evidence base for this morning's Falcon zero-day is 744 characters, and two of its sentences did not survive the retelling.

Exploit code for an unpatched local privilege escalation in CrowdStrike Falcon Sensor appeared at 02:48 UTC. The README contains two qualifications the coverage has dropped.

A machined dark aluminium cube sectioned open to reveal a second shell inside it, then a third, and at the centre a small crimson-lit core, on a dark surface.

Threat Intel2 Sept 2026

CISA catalogued three exploited flaws this evening that nobody has reported. Two of them cannot be found by vendor name.

Kestra, LiteLLM and Starlette joined the KEV catalogue at 16:54 UTC with no coverage at all. All three were months old, and the titles misdescribe two of them.

An ornate brass keyhole escutcheon on a dark aged wooden door, with a thin beam of warm light escaping through the open keyhole into the darkness, lit by a crimson rim light.

Threat Intel2 Sept 2026

A Chinese-speaking crew turned Brazilian .gov sites into SEO infrastructure. Their Apache module strips the CSP on three paths and leaves the rest correct.

Check Point Research documents Gambling Goblin compromising Brazilian government web servers since mid-2025. The module reverse-proxies three hardcoded prefixes and strips their Content-Security-Policy.

An antique brass klaxon alarm horn lying on a dark surface, its flared bell facing the camera, lit by a crimson rim light with the left half of the frame falling away into near black.

Threat Intel2 Sept 2026

SonicWall, JFrog and Langflow were reported exploited on one source each. CISA catalogued two of them eight hours later.

Read from the KEV feed and the NVD API on 2 September 2026: three loud exploitation claims, none catalogued, and a substitution trap where searching KEV by product name clears the wrong identifier.

A small sealed brown cardboard shipping carton on a dark matte surface, its shipping label torn away leaving a pale rectangle of adhesive residue, lit by a cold indigo rim light.

Threat Intel1 Sept 2026

Packagist removed thirteen malicious Composer themes. A fourteenth from the same operator is still listed.

Thirteen trojanised theme packages were pulled after Socket published. Checked by hand today: a sibling package Socket named as a sleeper is still installable, and the malicious jQuery is still on GitHub.

A blank manila envelope on a dark wooden desk, one corner slightly lifted to reveal darkness inside, lit by a cold indigo rim light.

Threat Intel1 Sept 2026

A fake coding test forbade AI assistants. The researchers say an AI would have caught the malware.

Kaspersky documents a recruitment lure whose README bans AI code review, declares the trojanised file bug-free, and ships a malicious package inside the archive so no scanner ever sees it.

A brass key blank lying on a dark workbench beside a pile of identical uncut blanks, lit by a cold indigo rim light against black.

Threat Intel1 Sept 2026

A 9.8 JFrog Artifactory bypass was exploited four days after disclosure. The patch shipped on day one.

CVE-2026-82329 lets an unauthenticated attacker reach admin on Artifactory. JFrog fixed it the same day it was published, its advisory misstates the 7.146 fix, and the exploitation claim rests on one firm.

A single strip of yellow and black striped hazard tape stretched across a dark open doorway, with the empty unlit room clearly visible beyond it.

Threat Intel1 Sept 2026

UAC-0099 hid a nuclear weapons essay in malware to stop AI analysis. Nobody has tested whether it works.

ESET disclosed an inert comment block designed to make AI analysis refuse. The whole primary source is three posts on X, nobody tested it, and Endor Labs documented the same trick in June.

Two identical blank sheets of heavy cream paper on a dark desk, the top one curling to reveal the copy beneath, captioned DoJ corrected one copy, the other still says victims, one of two, and 17 articles never corrected at all

Threat Intel31 Aug 2026

DoJ corrected its China hacking claim. It fixed one copy of two, and 17 articles still carry the original

A correction that reaches one of two identical documents has not been made. Both copies are live on justice.gov and they say different things.

A single glass tick box glowing cyan on a black background, captioned: eight stages in, not one is a CVE. 0 CVEs, no patch exists, because nothing is broken.

Threat Intel30 Aug 2026

TerminalFix chains eight stages from a fake CAPTCHA to a reverse tunnel, and never touches a CVE. There is nothing to patch

Every stage uses documented Windows behaviour, so there is no patch, no KEV deadline and no scanner finding. The controls that reach it had to be set before the lure arrived.

A brass pipe T-junction with one branch sealed by a blank cap, macro close-up against dark industrial pipework, the pipes edge-lit in cyan and the capped branch catching crimson light.

Threat Intel17 Aug 2026

Four CVEs let agent tools run without the model running at all. The guardrails were not bypassed, they were never asked

Black Hat 2026 research with four identifiers, one unpatched open-source path AWS has assigned to the customer, and the reason prompt hardening measured the wrong component.

A recessed circular power button ringed in crimson light on the dark brushed-metal front panel of a rack-mounted server, macro close-up, with a cyan edge light down the left side of the chassis.

Threat Intel14 Aug 2026

An Akira affiliate rebooted a host into Safe Mode to blind EDR. Defender named the ransomware and could not remove it for 28 minutes

Huntress documents the first Akira use of Safe Mode boot. The full technique chain contains no exploit at all, the encryptor starved of virtual memory and failed, and the victim is still extortable.

A single brass key resting on a stack of dark rectangular plates, macro close-up on a near-black surface, lit cyan along one side of the stack and crimson along the other.

Threat Intel14 Aug 2026

Jewelbug ran espionage and crypto fraud from one panel, with 580,000 stolen cookies logged. Symantec's own attribution doubts it was one team

One million implant check-ins, more than 15 government webmail tenants watering-holed by a single script tag, and a supplier relationship the coverage flattened into one team.

A square fingerprint reader sensor set into the brushed dark deck of a laptop, macro close-up beside the corner of a trackpad, ringed in crimson light against near-black.

Threat Intel13 Aug 2026