https://defend.network AI-powered cybersecurity threat intelligence. Daily briefings, vulnerability analysis, and security tool directory. en-us contact@defend.network (defend.network) contact@defend.network (defend.network) Sun, 19 Jul 2026 04:01:21 GMT https://defend.network/briefings/wordpress-7zip-nadmesh-acr-stealer-rce-2026-07-19.html https://defend.network/briefings/wordpress-7zip-nadmesh-acr-stealer-rce-2026-07-19.html Sun, 19 Jul 2026 06:30:00 GMT defend.network WordPress wp2shell RCE under active exploitation with public PoC. NadMesh botnet harvests 3,811 AWS keys from exposed AI services. 7-Zip patches critical archive RCE. Microsoft alerts on ACR Stealer surge. medium vulnerability-exploit malware technology healthcare https://defend.network/briefings/wordpress-openssl-fortinet-exploits-patched-2026-07-18.html https://defend.network/briefings/wordpress-openssl-fortinet-exploits-patched-2026-07-18.html Sat, 18 Jul 2026 06:30:00 GMT defend.network WordPress 6.9/7.0 core RCE patched Friday with forced updates; OpenSSL HollowByte DoS flaw allows 11-byte memory exhaustion; two Fortinet FortiSandbox command-injection vulns in CISA KEV catalog. NadMesh botnet harvesting AWS keys from exposed AI services. high vulnerability-exploit supply-chain technology https://defend.network/briefings/scattered-spider-sentenced-microsoft-570-patches-clickl-2026-07-17.html https://defend.network/briefings/scattered-spider-sentenced-microsoft-570-patches-clickl-2026-07-17.html Fri, 17 Jul 2026 06:30:00 GMT defend.network Two Scattered Spider members sentenced to 5.5 years for 2024 Transport for London attack. Microsoft releases record 570-CVE patch set. ClickLock macOS malware terminates apps until password stolen. high vulnerability-exploit malware government transportation https://defend.network/briefings/microsoft-sharepoint-zoom-windows-critical-exploits-2026-07-16.html https://defend.network/briefings/microsoft-sharepoint-zoom-windows-critical-exploits-2026-07-16.html Thu, 16 Jul 2026 06:30:00 GMT defend.network Microsoft SharePoint Server missing authentication flaw actively exploited; Windows User Profile Service zero-day PoC released; Zoom critical account takeover vulnerability disclosed. Microsoft patched record 570 flaws in latest Patch Tuesday. high zero-day vulnerability-exploit government technology https://defend.network/briefings/microsoft-sonicwall-github-zero-day-exploits-2026-07-15.html https://defend.network/briefings/microsoft-sonicwall-github-zero-day-exploits-2026-07-15.html Wed, 15 Jul 2026 06:30:00 GMT defend.network Microsoft patches record 622 flaws including two zero-days in Active Directory and SharePoint under active attack. SonicWall confirms exploitation of SMA1000 zero-days. GitHub supply-chain attack spreads 300 fake repositories with infostealer malware. critical zero-day vulnerability-exploit technology finance https://defend.network/briefings/modheader-extension-crashstealer-joomla-rce-exploits-2026-07-14.html https://defend.network/briefings/modheader-extension-crashstealer-joomla-rce-exploits-2026-07-14.html Tue, 14 Jul 2026 06:30:00 GMT defend.network Google and Microsoft remove ModHeader extension (1.6M installs) after discovering hidden tracking. CrashStealer macOS malware evades Gatekeeper using signed code. CISA warns of active Joomla extension exploitation. medium supply-chain malware technology retail https://defend.network/briefings/npm-supply-chain-zimbra-rce-android-malware-2026-07-13.html https://defend.network/briefings/npm-supply-chain-zimbra-rce-android-malware-2026-07-13.html Mon, 13 Jul 2026 06:30:00 GMT defend.network jscrambler npm package compromised with native infostealer; Zimbra stored XSS enables code execution; RedHook Android malware abuses wireless debugging for shell access. medium supply-chain malware technology https://defend.network/briefings/jscrambler-zimbra-injective-npm-supply-chain-2026-07-12.html https://defend.network/briefings/jscrambler-zimbra-injective-npm-supply-chain-2026-07-12.html Sun, 12 Jul 2026 06:30:00 GMT defend.network jscrambler npm 8.14.0 compromised with Rust infostealer, Zimbra XSS flaw enables code execution medium supply-chain malware technology finance https://defend.network/briefings/progress-sharefile-injective-uboot-firmware-threats-2026-07-11.html https://defend.network/briefings/progress-sharefile-injective-uboot-firmware-threats-2026-07-11.html Sat, 11 Jul 2026 06:30:00 GMT defend.network Progress Software orders immediate shutdown of ShareFile Storage Zone Controllers; Injective Labs GitHub compromise distributes crypto-stealing malware; six new U-Boot bootloader vulnerabilities discovered in IoT and data-center devices. medium supply-chain vulnerability-exploit technology finance https://defend.network/briefings/github-api-enumeration-gigawiper-windows-backdoor-npm-s-2026-07-10.html https://defend.network/briefings/github-api-enumeration-gigawiper-windows-backdoor-npm-s-2026-07-10.html Fri, 10 Jul 2026 06:30:00 GMT defend.network Datadog Security Labs warns of automated campaigns systematically enumerating corporate GitHub organizations via API abuse. Microsoft disassembles destructive GigaWiper backdoor combining disk wipe, ransomware, and spyware. npm 12 disables install scripts by default to reduce supply-chain risk. medium supply-chain malware technology https://defend.network/briefings/ubiquiti-unifi-hallusquatting-ai-coding-exploits-2026-07-09.html https://defend.network/briefings/ubiquiti-unifi-hallusquatting-ai-coding-exploits-2026-07-09.html Thu, 09 Jul 2026 06:30:00 GMT defend.network Ubiquiti patches critical UniFi flaws enabling privilege escalation and RCE across Connect, Talk, Access, Protect, AI coding assistants face new HalluSquatting attacks that trick them into installing botnet malware. medium vulnerability-exploit supply-chain technology https://defend.network/briefings/github-gitea-google-dialogflow-android-redwing-2026-07-08.html https://defend.network/briefings/github-gitea-google-dialogflow-android-redwing-2026-07-08.html Wed, 08 Jul 2026 06:30:00 GMT defend.network GitHub Agentic Workflows leak private repo data via public issues; Gitea CVE-2026-20896 authentication bypass actively exploited; RedWing Android malware rented as fraud service on Telegram. high vulnerability-exploit mobile-malware technology finance https://defend.network/briefings/adobe-coldfusion-linux-kvm-gitea-active-exploits-2026-07-07.html https://defend.network/briefings/adobe-coldfusion-linux-kvm-gitea-active-exploits-2026-07-07.html Tue, 07 Jul 2026 06:30:00 GMT defend.network Adobe ColdFusion max-severity RCE actively exploited; Linux KVM escape (CVE-2026-53359) affects Intel/AMD hosts; Gitea Docker auth bypass (CVE-2026-20896, CVSS 9.8) probed within 13 days; Iranian MOIS-linked group deploys new Cavern C2 framework against Israeli IT providers. critical vulnerability-exploit apt technology government https://defend.network/briefings/north-korea-malware-packages-avalon-framework-ransomwar-2026-07-06.html https://defend.network/briefings/north-korea-malware-packages-avalon-framework-ransomwar-2026-07-06.html Mon, 06 Jul 2026 06:30:00 GMT defend.network North Korean actors publish 108 malicious packages across npm, Packagist, Go, Chrome; Avalon modular framework combines credential theft with CrownX ransomware. U.S. government paid $1M extortion to Kairos group. medium malware ransomware technology government https://defend.network/briefings/north-korea-malware-linux-kernel-ransomware-ai-2026-07-05.html https://defend.network/briefings/north-korea-malware-linux-kernel-ransomware-ai-2026-07-05.html Sun, 05 Jul 2026 06:30:00 GMT defend.network North Korean actors published 108 malicious packages across npm and other ecosystems; Linux kernel RCE affects Android; first documented LLM-automated ransomware attack observed. medium malware ransomware technology https://defend.network/briefings/linux-kernel-fatfs-npm-supply-chain-threats-2026-07-04.html https://defend.network/briefings/linux-kernel-fatfs-npm-supply-chain-threats-2026-07-04.html Sat, 04 Jul 2026 06:30:00 GMT defend.network CVE-2026-46242 Linux kernel flaw enables root privilege escalation on Android, desktops, servers; patch available. Seven unpatched FatFs vulnerabilities in millions of embedded devices. North Korea-linked malicious npm packages target developer credentials. low vulnerability-exploit supply-chain technology https://defend.network/briefings/netnut-citrix-bleed-toddycat-oauth-gmail-2026-07-03.html https://defend.network/briefings/netnut-citrix-bleed-toddycat-oauth-gmail-2026-07-03.html Fri, 03 Jul 2026 06:30:00 GMT defend.network Google and FBI disrupt 2M-device NetNut proxy network; Anubis ransomware actively exploits Citrix Bleed 2 (CVE-2025-5777); ToddyCat malware abuses Google APIs to hijack Gmail accounts; Microsoft 365 OAuth bypass attacks steal tokens in seconds. high vulnerability-exploit malware technology https://defend.network/briefings/argo-cd-kubernetes-chocopoc-github-scattered-spider-2026-07-02.html https://defend.network/briefings/argo-cd-kubernetes-chocopoc-github-scattered-spider-2026-07-02.html Thu, 02 Jul 2026 06:30:00 GMT defend.network Unpatched Argo CD repo-server RCE enables full Kubernetes cluster takeover; weaponized GitHub PoCs deliver ChocoPoC RAT targeting security researchers; Scattered Spider leadership faces extradition and guilty pleas; DHS HSIN platform breached; Kubota confirms month-long network access. medium vulnerability-exploit supply-chain technology government https://defend.network/briefings/ai-agent-poisoning-microsoft-langflow-rce-cryptojacking-2026-07-01.html https://defend.network/briefings/ai-agent-poisoning-microsoft-langflow-rce-cryptojacking-2026-07-01.html Wed, 01 Jul 2026 06:30:00 GMT defend.network Microsoft research exposes AI agent manipulation via poisoned tool descriptions; Langflow RCE (CVE-2026-33017) actively exploited for Monero mining; six critical shell-injection bypasses discovered in open-source AI coding agents. high vulnerability-exploit credential-theft technology https://defend.network/briefings/oracle-peoplesoft-microsoft-chrome-credential-theft-2026-06-30.html https://defend.network/briefings/oracle-peoplesoft-microsoft-chrome-credential-theft-2026-06-30.html Tue, 30 Jun 2026 06:30:00 GMT defend.network Oracle PeopleSoft zero-day exploited at Nissan and NAIC; malicious Chrome extension intercepted searches and address bar input; Mustang Panda uses Zoho WorkDrive in Indian government campaigns. critical data-breach credential-theft finance government https://defend.network/briefings/russian-phishing-signal-cisco-breach-2026-06-29.html https://defend.network/briefings/russian-phishing-signal-cisco-breach-2026-06-29.html Mon, 29 Jun 2026 06:30:00 GMT defend.network Russian intelligence phishing campaign now targets Signal backup recovery keys; Cisco vulnerability under active exploitation with CISA emergency deadline; KDDI email breach exposes 14.2M credentials across six ISPs. medium phishing apt government telecom https://defend.network/briefings/russian-signal-phishing-turla-malware-github-ai-2026-06-28.html https://defend.network/briefings/russian-signal-phishing-turla-malware-github-ai-2026-06-28.html Sun, 28 Jun 2026 06:30:00 GMT defend.network Russian intelligence expanding Signal phishing to steal backup keys; Turla deploys StockStay malware against Ukraine; AI coding agents tricked into executing malware via GitHub repositories. medium phishing apt government https://defend.network/briefings/signal-phishing-linux-kernel-aws-credential-theft-2026-06-27.html https://defend.network/briefings/signal-phishing-linux-kernel-aws-credential-theft-2026-06-27.html Sat, 27 Jun 2026 06:30:00 GMT defend.network Russian intelligence phishing now targets Signal Backup Recovery Keys. Linux kernel privilege escalation (CVE-2026-46331) has working exploit. AWS Q flaw (CVE-2026-12957, CVSS 8.5) allows malicious repos to steal cloud credentials. low phishing credential-theft government technology https://defend.network/briefings/lantronix-eds5000-cisco-sd-wan-cordyceps-github-2026-06-25.html https://defend.network/briefings/lantronix-eds5000-cisco-sd-wan-cordyceps-github-2026-06-25.html Thu, 25 Jun 2026 06:30:00 GMT defend.network Lantronix EDS5000 critical flaw in active exploitation; CISA mandates patching by June 26. Amadey/StealC malware networks dismantled, 27M credentials recovered. Cordyceps CI/CD weakness affects 300+ GitHub repositories. high vulnerability-exploit supply-chain government technology https://defend.network/briefings/fortibleed-cisco-github-ai-credential-theft-2026-06-24.html https://defend.network/briefings/fortibleed-cisco-github-ai-credential-theft-2026-06-24.html Wed, 24 Jun 2026 06:30:00 GMT defend.network FortiBleed credential-harvesting campaign collected 110 million credentials from 430 high credential-theft vulnerability-exploit technology