LIVE FEED

HIGH: Oracle PeopleSoft CVE-2026-35273 — ShinyHunters mass exploitation via WAF bypass, web shells deployed◆HIGH: Microsoft releases 974 patches in largest batch ever; Windows/Office administrators must prioritize testing◆HIGH: Elementor WordPress plugin CSRF flaw — unauthenticated attackers can create admin accounts and seize sites◆HIGH: Lunex stealer malware abuses AMD drivers to disable EDR, harvest browser credentials via MaaS platform◆HIGH: CISA KEV update — MikroTik RouterOS and SharePoint RCE actively exploited; federal remediation deadline Sept 28◆HIGH: HIGH — GitHub Actions compromised twice: Mini Shai-Hulud malware resumed after re-access gained◆HIGH: HIGH — Bitget $351.6M theft attributed to suspected North Korean attackers; backend compromise confirmed◆HIGH: HIGH — Roundcube CVE-2026-48842 actively exploited; pre-auth SQL injection (CVSS 8.1)◆HIGH: Oracle PeopleSoft CVE-2026-35273 — ShinyHunters mass exploitation via WAF bypass, web shells deployed◆HIGH: Microsoft releases 974 patches in largest batch ever; Windows/Office administrators must prioritize testing◆HIGH: Elementor WordPress plugin CSRF flaw — unauthenticated attackers can create admin accounts and seize sites◆HIGH: Lunex stealer malware abuses AMD drivers to disable EDR, harvest browser credentials via MaaS platform◆HIGH: CISA KEV update — MikroTik RouterOS and SharePoint RCE actively exploited; federal remediation deadline Sept 28◆HIGH: HIGH — GitHub Actions compromised twice: Mini Shai-Hulud malware resumed after re-access gained◆HIGH: HIGH — Bitget $351.6M theft attributed to suspected North Korean attackers; backend compromise confirmed◆HIGH: HIGH — Roundcube CVE-2026-48842 actively exploited; pre-auth SQL injection (CVSS 8.1)◆

UPDATED DAILY

AI-monitored threat intelligence

Cyber threat
intelligence,
verified &
prioritized.

AI-generated daily briefings and vulnerability analysis for security teams who need signal, not noise.

Read Today’s Briefing → Subscribe Free

HIGH/ SEPTEMBER 27, 2026TODAY’S BRIEFING — #191

Oracle PeopleSoft, Microsoft patches, Elementor RCE under active exploitation

Oracle PeopleSoft CVE-2026-35273 (CVSS 9.8) under mass exploitation via WAF bypass; ShinyHunters deploying web shells globally. Microsoft released 974 security patches. Lunex stealer abuses AMD drivers to disable EDR and harvest credentials.

CVE-2026-35273Oracle Peoplesoft Enterprise Peopletools — Critical flaw (CVSS 9.8) under active mass exploitation via WAF bypass; web shell deployment reported CVE-2026-69730Microsoft Windows 10 1607 — Patched in Microsoft's 974-CVE batch; specific exploitation status not detailed in sources CVE-2026-65660Microsoft Sharepoint Server — Code injection vulnerability actively exploited; added to CISA KEV catalog CVE-2026-67279Mikrotik Routeros — Behavioral workflow bypass; actively exploited; added to CISA KEV catalog; can chain with CVE-2026-86060

Read the full briefing →

191 briefings published

27 vuln reports

59 tools indexed

$0 for security teams

LIVE — THIS WEEK

Critical vulnerabilities

Full report →

CVE	Product	CVSS	Exploited	Patch
CVE-2026-5430	WSO2 Multiple Products	10	KEV	advisory
CVE-2026-76460	Cisco Identity Services Engine	10	KEV	advisory
CVE-2026-93952	Arista VeloCloud Orchestrator	10	KEV	advisory
CVE-2026-20079	Cisco Secure Firewall Management Center (FMC) And Security Cloud Control (SCC) Firewall Management	10	KEV	advisory
CVE-2026-85706	GitLab Community Edition And Enterprise Edition	10	KEV	—

KEV = listed in CISA catalog · IN WILD = active exploitation reported · PoC = public exploit code

LATEST INTELLIGENCE

Daily briefings

View all 191 briefings →

HighSeptember 27, 2026

Oracle PeopleSoft, Microsoft patches, Elementor RCE under active exploitation

Vuln ExploitMalwareCredential TheftTechnologyFinanceGovernment

HighSeptember 26, 2026

GitHub Actions re-compromised; North Korea suspected in $351M Bitget heist

Compromised GitHub Actions resumed executing malware after re-gaining access, WSO2, Adobe remain under active exploitation.

Supply ChainAPTCredential TheftTechnologyFinance

CriticalSeptember 25, 2026

Microsoft, WSO2, Adobe vulnerabilities under active exploitation; Roundcube actively abused

CISA added five critical vulnerabilities to its Known Exploited Vulnerabilities catalog, including WSO2 path traversal (CVE-2026-5430) and Adobe Commerce auth bypass (CVE-2026-71362). Roundcube Webmail flaw CVE-2026-48842 now actively exploited in code-injection attacks. Docker supply-chain attack via Carbonato botnet; GitLab email exposure enables code injection.

Vuln ExploitMalwareSupply ChainCredential TheftTechnologyRetail

HighSeptember 24, 2026

Check Point RCE, MikroTik SSH chain, malicious npm/Terraform packages in active exploitation

Check Point VPN gateway (CVE-2026-85102) actively exploited, MikroTik routers compromised via SSH chain, malicious Go malware in HashiCorp Terraform, npm

Vuln ExploitSupply ChainCredential TheftMalwareGovernmentFinanceTechnology

Explore by Threat Type

Volume 30d · color = momentum

Zero-Day Vuln Exploit Supply Chain Credential Theft APT Data Breach Malware Ransomware Phishing IoT / OT DDoS Insider Threat Mobile Malware BEC Compliance Cryptojacking

Sector Heatmap

Volume 30d · color = momentum

Technology Finance Government Healthcare Education Defense Manufacturing Retail Telecom Energy Legal Transportation Media

Surging Rising Steady Cooling Color = last 15 days vs prior 15 · number = briefings in 30 days

Security Tools Directory

Open full directory →

59 security tools indexed · free + paid + open source · updated regularly

🔍

Bitdefender GravityZone

Paid

Free

Paid

Freemium

SentinelOne Singularity

Paid

Free

Paid

Paid

Free

Free

Free

SIEM & Log Management

Freemium

Graylog Open

SIEM & Log Management

Free

Microsoft Sentinel

SIEM & Log Management

Paid

Splunk Enterprise Security

SIEM & Log Management

Paid

Wazuh SIEM

SIEM & Log Management

Free

Cisco Duo

Identity & Access Management

Freemium

CyberArk

Identity & Access Management

Paid

Keycloak

Identity & Access Management

Free

Okta

Identity & Access Management

Paid

Paid

Free

Freemium

Paid

Vulnerability Management

Free

OpenVAS (Greenbone)

Vulnerability Management

Free

Qualys VMDR

Vulnerability Management

Paid

Rapid7 InsightVM

Vulnerability Management

Paid

Tenable Nessus

Vulnerability Management

Paid

Paid

Free

Free

Paid

Threat Intelligence Platforms

Freemium

MISP

Threat Intelligence Platforms

Free

OpenCTI

Threat Intelligence Platforms

Free

Recorded Future

Threat Intelligence Platforms

Paid

Acronis Cyber Protect

Backup & Disaster Recovery

Paid

Restic

Backup & Disaster Recovery

Free

Veeam Backup

Backup & Disaster Recovery

Paid

GoPhish

Security Awareness Training

Free

KnowBe4

Security Awareness Training

Paid

Phished

Security Awareness Training

Freemium

Paid

Freemium

Paid

Free

Cloudflare Zero Trust

VPN & Zero Trust Network Access

Freemium

Tailscale

VPN & Zero Trust Network Access

Free

WireGuard

VPN & Zero Trust Network Access

Free

Zscaler Private Access

VPN & Zero Trust Network Access

Paid

Burp Suite

Penetration Testing & Red Team

Free

Kali Linux

Penetration Testing & Red Team

Free

Metasploit

Penetration Testing & Red Team

Freemium

Nmap

Penetration Testing & Red Team

Free

sqlmap

Penetration Testing & Red Team

Free

Paid

Free

Paid

⚖️ Compare any tools side-by-side →

Pick up to 4 tools to compare pricing, deployment, and capabilities

ABOUT THIS SITE

How It Works

Our methodology →

We monitor

Once a day at 04:00 UTC, the pipeline pulls ten authoritative security feeds – including CISA advisories – and extracts the day’s most important stories and the CVEs they cite.

We verify

Every CVE is checked against NVD for canonical CVSS and cross-referenced with the CISA KEV catalog. Inline citations link each story to its sources, and a skeptical second AI pass flags – or blocks – claims it can’t substantiate.

You act

Severity is scored from CVSS and confirmed exploitation – not editorial tone – so Critical is rare by design. Structured briefings tell your team exactly what to patch, investigate, or escalate.

Get the Daily Briefing in Your Inbox

Join security professionals who start their morning with defend.network intelligence. Free forever.

Cyber threatintelligence,verified &prioritized.

Oracle PeopleSoft, Microsoft patches, Elementor RCE under active exploitation

Critical vulnerabilities

Daily briefings

Oracle PeopleSoft, Microsoft patches, Elementor RCE under active exploitation

GitHub Actions re-compromised; North Korea suspected in $351M Bitget heist

Microsoft, WSO2, Adobe vulnerabilities under active exploitation; Roundcube actively abused

Check Point RCE, MikroTik SSH chain, malicious npm/Terraform packages in active exploitation

Explore by Threat Type

Sector Heatmap

Security Tools Directory

How It Works

We monitor

We verify

You act

Get the Daily Briefing in Your Inbox

Cyber threat
intelligence,
verified &
prioritized.