LIVE FEED
HIGH: Android zero-day CVE-2025-48595 exploited; patch 124 flaws immediately◆HIGH: WordPress Kirki CVE-2026-8206 — admin account hijacking attacks active◆HIGH: Gamaredon exploits WinRAR CVE-2025-8088 to deliver GammaWorm/GammaSteel in Ukraine◆HIGH: Oracle WebLogic CVE-2024-21182 added to CISA KEV catalog — patch urgent◆HIGH: AI ransomware toolkit automates AD discovery, evades EDR solutions◆MED: RED HAT npm — 30+ @redhat-cloud-services packages compromised with Miasma credential-stealing worm◆MED: WORDPRESS (WP Maps Pro) — CVE-2026-8732 RCE actively exploited; unauthenticated admin account creation◆MED: INSTAGRAM — Obama White House & U.S. Space Force accounts defaced; Meta AI support bot exploited for account takeover◆HIGH: Android zero-day CVE-2025-48595 exploited; patch 124 flaws immediately◆HIGH: WordPress Kirki CVE-2026-8206 — admin account hijacking attacks active◆HIGH: Gamaredon exploits WinRAR CVE-2025-8088 to deliver GammaWorm/GammaSteel in Ukraine◆HIGH: Oracle WebLogic CVE-2024-21182 added to CISA KEV catalog — patch urgent◆HIGH: AI ransomware toolkit automates AD discovery, evades EDR solutions◆MED: RED HAT npm — 30+ @redhat-cloud-services packages compromised with Miasma credential-stealing worm◆MED: WORDPRESS (WP Maps Pro) — CVE-2026-8732 RCE actively exploited; unauthenticated admin account creation◆MED: INSTAGRAM — Obama White House & U.S. Space Force accounts defaced; Meta AI support bot exploited for account takeover◆
UPDATED DAILY
AI-monitored threat intelligence

Cyber threat
intelligence,
verified &
prioritized.

AI-generated daily briefings and vulnerability analysis for security teams who need signal, not noise.

Read Today’s Briefing → Subscribe Free
● HIGH/ JUNE 3, 2026TODAY’S BRIEFING — #077

Android, WinRAR, WordPress Kirki: Three critical zero-days under active exploitation

Google Android zero-day (CVE-2025-48595) actively exploited; Gamaredon APT weaponizing WinRAR; WordPress Kirki plugin hijacking admin accounts. CISA adds Oracle WebLogic to KEV catalog.

CVE-2025-48595Google Android — High-severity zero-day actively exploited in the wild; CVSS 8.4CVE-2025-8088Rarlab Winrar — Path traversal vulnerability actively exploited by Gamaredon APT to deliver malwareCVE-2026-8206WordPress Kirki Plugin — Critical privilege escalation actively exploited to hijack admin accountsCVE-2024-21182Oracle Weblogic Server — High-severity vulnerability (CVSS 7.5) added to CISA KEV catalog; active exploitation confirmed
Read the full briefing →
77 briefings published
11 vuln reports
59 tools indexed
$0 for security teams
LIVE — THIS WEEK

Critical vulnerabilities

Full report →
CVEProductCVSSExploitedPatch
CVE-2026-39987Marimo9.8KEV✓ available
CVE-2026-0257Paloaltonetworks Pan-Os9.1KEV✓ available

KEV = listed in CISA catalog · IN WILD = active exploitation reported · PoC = public exploit code

LATEST INTELLIGENCE

Daily briefings

View all 77 briefings →
● HighJune 3, 2026

Android, WinRAR, WordPress Kirki: Three critical zero-days under active exploitation

Google Android zero-day (CVE-2025-48595) actively exploited; Gamaredon APT weaponizing WinRAR; WordPress Kirki plugin hijacking admin accounts. CISA adds Oracle WebLogic to KEV catalog.

Zero-DayVuln ExploitAPTMalwareTechnologyGovernment
● MediumJune 2, 2026

Red Hat npm, WordPress, Instagram under active attack; critical Windows vulnerability patching urgent

Red Hat npm packages compromised with Miasma credential-stealing worm; WordPress RCE via CVE-2026-8732; Instagram accounts hijacked via Meta AI bot exploit. Patch WP Maps Pro immediately, rotate developer credentials, enable MFA.

Supply ChainVuln ExploitCredential TheftMalwareTechnologyGovernment
● HighJune 1, 2026

PAN-OS GlobalProtect actively exploited; Russian infrastructure dismantled; Linux kernel flaw

Palo Alto PAN-OS GlobalProtect authentication bypass (CVE-2026-0257) actively exploited; Dutch authorities arrest two hosting operators supporting Russian cyberattacks; Linux kernel CIFSwitch flaw allows privilege escalation.

Vuln ExploitAPTData BreachMalwareGovernmentTechnologyFinance
● HighMay 31, 2026

Active exploits: Palo Alto GlobalProtect, CISA credential leak, Linux kernel RCE

Palo Alto PAN-OS GlobalProtect flaw (CVE-2026-0257) under active exploitation; CISA contractor exposed AWS GovCloud keys on GitHub; Linux kernel CIFSwitch privilege escalation disclosed.

Vuln ExploitCredential TheftDDoSPhishingTechnologyGovernment

Explore by Threat Type

Activity & severity · last 30 days

Sector Heatmap

Coverage & severity · last 30 days
Critical High Medium Low rising critical mentions

Security Tools Directory

Open full directory →

59 security tools indexed · free + paid + open source · updated regularly

🔍
Bitdefender GravityZone
Endpoint Security
Paid
ClamAV
Endpoint Security
Free
CrowdStrike Falcon
Endpoint Security
Paid
Microsoft Defender
Endpoint Security
Freemium
SentinelOne Singularity
Endpoint Security
Paid
Wazuh
Endpoint Security
Free
Fortinet FortiGate
Network Security
Paid
Palo Alto NGFW
Network Security
Paid
pfSense CE
Network Security
Free
Snort
Network Security
Free
Suricata
Network Security
Free
Elastic Security
SIEM & Log Management
Freemium
Graylog Open
SIEM & Log Management
Free
Microsoft Sentinel
SIEM & Log Management
Paid
Splunk Enterprise Security
SIEM & Log Management
Paid
Wazuh SIEM
SIEM & Log Management
Free
Cisco Duo
Identity & Access Management
Freemium
CyberArk
Identity & Access Management
Paid
Keycloak
Identity & Access Management
Free
Okta
Identity & Access Management
Paid
Abnormal Security
Email Security
Paid
MailScanner
Email Security
Free
Mimecast
Email Security
Freemium
Proofpoint
Email Security
Paid
Nuclei
Vulnerability Management
Free
OpenVAS (Greenbone)
Vulnerability Management
Free
Qualys VMDR
Vulnerability Management
Paid
Rapid7 InsightVM
Vulnerability Management
Paid
Tenable Nessus
Vulnerability Management
Paid
Orca Security
Cloud Security
Paid
Prowler
Cloud Security
Free
Trivy
Cloud Security
Free
Wiz
Cloud Security
Paid
AlienVault OTX
Threat Intelligence Platforms
Freemium
MISP
Threat Intelligence Platforms
Free
OpenCTI
Threat Intelligence Platforms
Free
Recorded Future
Threat Intelligence Platforms
Paid
Acronis Cyber Protect
Backup & Disaster Recovery
Paid
Restic
Backup & Disaster Recovery
Free
Veeam Backup
Backup & Disaster Recovery
Paid
GoPhish
Security Awareness Training
Free
KnowBe4
Security Awareness Training
Paid
Phished
Security Awareness Training
Freemium
1Password
Password Management
Paid
Bitwarden
Password Management
Freemium
Dashlane Business
Password Management
Paid
KeePass
Password Management
Free
Cloudflare Zero Trust
VPN & Zero Trust Network Access
Freemium
Tailscale
VPN & Zero Trust Network Access
Free
WireGuard
VPN & Zero Trust Network Access
Free
Zscaler Private Access
VPN & Zero Trust Network Access
Paid
Burp Suite
Penetration Testing & Red Team
Free
Kali Linux
Penetration Testing & Red Team
Free
Metasploit
Penetration Testing & Red Team
Freemium
Nmap
Penetration Testing & Red Team
Free
sqlmap
Penetration Testing & Red Team
Free
Drata
Compliance & GRC
Paid
Eramba
Compliance & GRC
Free
Vanta
Compliance & GRC
Paid
⚖️ Compare any tools side-by-side →

Pick up to 4 tools to compare pricing, deployment, and capabilities

ABOUT THIS SITE

How It Works

Our methodology →
1

We monitor

AI agents continuously scan CISA advisories, NVD, vendor bulletins, and 10 leading threat intelligence sources around the clock.

2

We verify

Every CVE is checked against NVD for canonical CVSS and cross-referenced with the CISA KEV catalog. Each claim is traced to its source article, and a second independent AI pass flags anything it can’t substantiate.

3

You act

Severity is scored from CVSS and confirmed exploitation – not editorial tone – so Critical is rare by design. Structured briefings tell your team exactly what to patch, investigate, or escalate.

Get the Daily Briefing in Your Inbox

Join security professionals who start their morning with defend.network intelligence. Free forever.