Defense Industry Intelligence

Defense and military organizations face the most sophisticated threat actors in the cybersecurity landscape, including nation-state espionage programs targeting classified information, weapons systems, and defense supply chains. defend.network tracks threats to the defense industrial base, military networks, and cleared contractor environments.

Tailscale SSH, LiteLLM supply-chain, Arista VeloCloud exploits active

Tailscale SSH flaws enable root escalation from compromised devices, LiteLLM master key leak poisoned Python package

Citrix NetScaler zero-day under attack; ShinyHunters member detained; DTU breach

Citrix NetScaler CVE-2026-88779 actively exploited in zero-day attacks; patches released. ShinyHunters member detained in Jordan aiding FBI. Danish university DTU breach exposes 200,000 records. TA419 phishing targets U.S. AI policy experts.

Azure AI, Cisco ISE, WordPress flaws under active exploitation; 23M Gyazo breach

Microsoft patches CVSS 10.0 Azure AI Foundry privilege escalation; Cisco ISE authentication bypass added to CISA KEV; WordPress core flaw forces theme installs; 23.6M Gyazo user records stolen via server vulnerability.

Check Point VPN & Tencent flaws in active exploitation; RubyGems RCE confirmed

Critical Check Point VPN flaws face imminent exploitation; Tencent Input Method vulnerability deployed for GrayRabbit malware; OpenAI agents linked to May RubyGems RCE campaign gaining server access.

Microsoft 974 patches, GitLab CVSS 10 exploited, Russia weaponizes Claude

Microsoft released 974 patches (largest batch ever); GitLab CVSS 10 flaw exploited within hours; Anthropic disrupted seven China-based labs running Claude distillation attacks and separately detected Russia-linked espionage targeting 20+ government entities.

GitLab CVSS 10 exploited in wild; Microsoft ships 974 patches; Claude abused by state actors

GitLab path-traversal flaw (CVSS 10.0) exploited in-the-wild; Microsoft patches 974 CVEs; Russian state actors abuse Claude for malware rebuilding.

SharePoint, Windows zero-day exploited; Lazarus backdoor in defense sector

SharePoint CVE-2026-55040 (CVSS 9.1) under active exploitation; Lazarus deploys Windows zero-day backdoor targeting defense/aerospace in France, Germany, Brazil, India; 737 malicious Chrome VPN extensions intercept traffic.

Microsoft patches 398 flaws; SharePoint exploited; Lazarus deploys Windows backdoor

Microsoft patched 398 vulnerabilities with one under active exploitation. SharePoint auth bypass (CVE-2026-55040) being exploited post-PoC. Lazarus deployed Windows zero-day backdoor targeting defense/aerospace in 4 countries.

SharePoint, SAP, macOS flaws under active exploitation; 737 malicious Chrome extensions

SharePoint CVE-2026-55040 (CVSS 9.1) actively exploited post-PoC release. SAP Commerce Cloud RCE targeted within 72 hours of patch. macOS Screen Sharing bypass deployed for Monero mining. 737 malicious Chrome VPN extensions intercept user traffic.

Lazarus Windows zero-day, Adobe CVSS 10.0 patches, 737 malicious Chrome VPN extensions

Lazarus Group exploits patched Windows zero-day to target defense/aerospace in four countries. Microsoft patches 398 vulns; Adobe releases CVSS 10.0 fixes. 737 fake Chrome VPN extensions intercept traffic via attacker proxies.

China espionage dwell 1 year, Microsoft 200 patches, Cisco SD-WAN actively exploited

China-linked UNC6508 maintained undetected access to North American medical, military, and academic research networks for over a year via compromised REDCap servers. Microsoft issued record 200 patches with evidence of active exploitation. Cisco SD-WAN vManage CVE-2026-20262 exploited in the wild.

Langflow RCE exploited, JDY botnet expands U.S. military targeting, npm security hardened

CVE-2026-5027 in Langflow actively exploited for unauthenticated RCE; JDY botnet expands to 1,500 devices targeting U.S. military networks. CISA mandates 3-day patching for critical flaws.

FIRESTARTER federal Cisco persistence; Chinese APT GopherWhisper

Critical threats include FIRESTARTER backdoor persistence on federal Cisco devices, Russian military token theft via router exploitation, Chinese APT GopherWhisper attacks, and four actively exploited CISA KEV vulnerabilities with May 2026 federal patching deadline.

FIRESTARTER on federal Cisco gear; 4 critical CVEs added to CISA KEV

FIRESTARTER backdoor persists on federal Cisco infrastructure despite patches; Russian state actors harvesting Office tokens via router exploits; four critical CVEs added to CISA KEV with May 2026 deadline; APT campaigns targeting U.S. defense sector; AI-powered phishing escalates to personalized 1-to-1 attacks.

FIRESTARTER persists on federal Cisco; APT spear-phishes NASA

FIRESTARTER backdoor persists on federal Cisco infrastructure despite patches. Russian military intelligence harvesting Office tokens via router exploits. Chinese APT targeting NASA and defense sector with spear-phishing. AI-powered phishing and FakeWallet credential theft escalating.

APT28 PRISMEX on NATO; ActiveMQ 13-yr RCE; Russian router token theft

APT28 deploys PRISMEX malware targeting NATO allies; 13-year-old ActiveMQ RCE and Russian router-based token theft critical; new botnets and healthcare ransomware disruptions.

APT28 DNS hijack via routers; Iran hits PLCs; Docker RCE

Russian APT28 conducting large-scale DNS hijacking via compromised routers for token theft; Iranian hackers targeting U.S. critical infrastructure PLCs; critical Docker and Flowise vulnerabilities under active exploitation.

TA416 PlugX on EU govts; UNC1069 Axios npm; device code phishing 37x

Nation-state campaigns targeting European governments and supply chain infrastructure. TA416 resumes targeting with PlugX. North Korean UNC1069 compromises Axios npm. Device code phishing surges 37x.

AI autonomous espionage; device code phishing at 340+ orgs

AI-powered autonomous cyber espionage, device code phishing at 340+ organizations, and critical infrastructure vulnerabilities require immediate defensive action across all sectors.

Russian phishing on Signal/WhatsApp; Oracle RCE exploited

Russian intelligence conducting mass Signal/WhatsApp phishing; critical Oracle RCE vulnerability; Trivy supply-chain attack spreads CanisterWorm across 47+ npm packages; VoidStealer bypasses Chrome encryption; Iran-backed wiper attacks on medical technology.

Vulnerability Report – Week 2 of July 2026

Multiple operational technology products from Rockwell Automation and related vendors were disclosed by CISA with privilege escalation and code execution impacts, though CVE IDs were not fully specifi

Vulnerability Report – Week 5 of June 2026

This week's verified CVE activity is light, with only two explicitly identified vulnerabilities in the source material. The most urgent priority is CVE-2026-45659, which CISA reports as actively explo

Vulnerability Report – Week 3 of May 2026

This week presents an exceptionally high-risk threat landscape with multiple critical vulnerabilities under active exploitation across infrastructure, enterprise, and open-source ecosystems. Immediate

Vulnerability Report – Week 2 of May 2026

This week marks a significant surge in actively exploited vulnerabilities, with three critical flaws requiring immediate patching across IT infrastructure and OT systems. The Ollama out-of-bounds read

Vulnerability Report – Week 1 of May 2026

This week presents an exceptionally high-risk threat landscape dominated by active exploitation campaigns and critical infrastructure vulnerabilities. Federal agencies face an immediate Sunday deadlin

Vulnerability Report – Week 4 of April 2026

This week presents elevated risk from actively exploited vulnerabilities across network infrastructure, IoT devices, and enterprise software. Immediate patching is required for Cisco Firepower/ASA dev

Vulnerability Report – Week 3 of April 2026

This week presents elevated risk across OT/ICS sectors with multiple critical RCE vulnerabilities in industrial control systems and emerging threats to cloud infrastructure. Active exploitation of Mic

Vulnerability Report – Week 2 of April 2026

This week presents an elevated threat landscape dominated by actively exploited critical vulnerabilities in both IT and OT environments. Iranian-affiliated threat actors are actively targeting US crit

Vulnerability Report – Week 1 of April 2026

This week presents elevated risk with five critical vulnerabilities actively exploited in the wild, including FortiClient EMS and video conferencing systems requiring immediate patching. Organizations

Vulnerability Report – Week 5 of March 2026

This week reflects sustained critical threats across OT/ICS and enterprise systems with multiple actively exploited vulnerabilities. F5 BIG-IP APM (CVE-2025-53521) and Citrix NetScaler (CVE-2026-3055)