A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the ...

NeedyMantis maintains long-term access in targeted intrusions, using DLL sideloading and HTTPS-to-WebSocket command-and-control.

American tech company Kiteworks has lifted a precautionary advisory asking customers to shut down systems after patching a critical vulnerability.

GTIG is tracking exploitation of critical vulnerabilities in Citrix NetScaler ADC NetScaler Gateway products.

Since January 2026, Microsoft has observed Russian state threat actor Star Blizzard evolve their detection evasion capabilities through large-scale phishing campaigns, the use of accounts on compromis...

Apple released security updates to fix a zero-day vulnerability exploited in "extremely sophisticated" targeted attacks on iOS devices.

Learn more about GitLab Critical Patch Release: 19.4.1, 19.3.3, 19.2.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).

**Prerequisites** (both conditions must hold; both are deployment properties, not attacker-controlled at request time): - The `jwt.decode` allow-list mixes an HMAC algorithm with an asymmetric one...

Wiz Research analyzes NordStellar data to map credentials targeted by infostealers and assess their impact across cloud, code, and AI environments.

A hardcoded key plus two path traversals plus an unsafe pickle load, chained into root RCE and a full cloud compromise on a Meta service.

A purported ad-blocker exfiltrates reams of sensitive information and benefits from having Google's stamp of approval despite researcher warnings.

Carbonato targets unauthenticated Docker daemons, installs Hermes Agent, and uses Telegram to run operator-directed AI-generated commands.

The JadePuffer ransomware operator is targeting Azure tenants with agent-driven attacks that conduct reconnaissance, steal credentials, and destroy core components.

Unit 42 is aware of possible 0-day activity against NetScaler devices. Citrix reports CVE-2026-88771, CVE-2026-88772 have been exploited in the wild.

Microsoft Threat Intelligence identified NeedyMantis, a modular post-compromise malware framework used in targeted intrusions that combines custom loaders, encrypted archives, and extensible component...

This page provides complete set of Administrative Templates (.admx) for Windows 11 2026 Update (26H2)

Lunex uses BYOVD to disable kernel security callbacks before stealing browser credentials and cryptocurrency wallets.

Cloudflare has fixed a vulnerability in Containers and Sandboxes that allowed customers with a Workers Paid account to recover residual data from other customers' containers on the same physical host.

Microsoft calls it by design. First reported in 2007, the leak shows another account your Firefox visits, and the April 2025 fix ships switched off.

PamStealer now uses live key exchange to block static payload recovery and is delivered through a fake Wavel macOS download.

Two third-party GitHub Actions previously compromised in a Mini Shai-Hulud campaign were re-enabled by their maintainer and remained accessible for more than a week despite still pointing to malicious...

Learn how ransomware threat intelligence empowers your team to actively follow adversary infrastructure, monitor dark web chatter and prevent attacks.

### Summary The iOS Control UI did not enforce saved Gateway TLS pins. In affected versions, authenticated Terminal and session Dashboard WebViews omitted the saved Gateway fingerprint even though...

Manufacturer writes to its customers that they have concrete indications from law enforcement about an attack. Large companies are also affected in this country.

A storm is raging in the form of cyber sabotage, disinformation, and drone attacks on European nations, particularly those that provide support to Ukraine.

​The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies on Wednesday that ransomware gangs are now also exploiting a critical JetBrains TeamCity vulnerability patched...

Kothamine uses a legitimate Tailscale tool to receive attackers’ commands through an encrypted connection with no malicious domain to block.

We explain in simple terms why the CVE-2026-87902 vulnerability is dangerous, and how to protect your company against it.

CVE-2026-28326 is an unauthenticated RCE in SolarWinds ARM where a hardcoded shared secret on TCP 55555 leads to SYSTEM-level code execution. Patch now.

The alleged deception could have given Russian agents a foothold inside a company providing technology to government customers.

A court in Zurich has sentenced a Ukrainian man to 12 years and nine months in prison, and banned him from Switzerland for ten years, for developing ransomware that blackmailed companies around the wo...

Well, well, well, well, well, well, well, well, well, well, well, well, well, well, well. We're back. Sorry. We've been watching the onslaught of vulnerabilities flood the internet. Every man, dog, a...

Storm-2570 is a ransomware affiliate that uses consistent post-compromise tools and techniques across deployments involving Qilin, DragonForce, Anubis, and BERT ransomware, and provides guidance to he...

This post is a follow-up to our July 27, 2026, announcement about CVE-2026-63077. Summary Since our initial announcement on July 27, 2026, we have received reports of active exploitation, as we

Nightmare Eclipse says he is Abdelhamid Naceri, a former MSRC researcher. Discover his account of the Microsoft firing and lawsuit.

A scammer asks you to enter a code to open a file or join a meeting. Approving it could sign them in to your account instead.

A Chinese-speaking threat actor has been exploiting vulnerabilities in ZyXEL GS1900 Smart Managed Switches and WordPress to steal sensitive data from 996 devices and more than 18,500 records stored in...

An Armenian man was sentenced to 24 months in prison and 3 years of supervised release for hacking U.S. companies and encrypting their systems in Ryuk ransomware attacks.

This security release features a fix for a critical severity security vulnerability. Because this is a security release, it is recommended that you update your sites immediately. You can download W…

BigDiskBuster leaves Microsoft's antivirus running but unable to install updates

Microsoft Threat Intelligence examines attacks on exposed AI workloads, including LiteLLM gateway exploitation, credential harvesting, persistence, and cryptomining activity.