Government Industry Intelligence
Government agencies at all levels face threats from nation-state actors, hacktivists, and criminal groups seeking sensitive data or disruptive impact. Federal mandates like CISA directives create specific patch timelines that government security teams must meet. defend.network tracks threats targeting government infrastructure, including CISA advisories, federal agency breaches, and attacks against election and critical infrastructure systems.
Threat Briefings
FBI confirms $6.3B Binance heist; critical LXD/MicroCloud flaw; Polymarket $2.7M theft
FBI attributed record $6.3B Binance cryptocurrency heist to North Korean TraderTraitor group. Critical CVSS 10.0 flaw in LXD/MicroCloud enables authentication bypass. Polymarket lost $2.7M to supply-chain script injection; Northflank breach exposed AI API keys.
Linux kernel, PHP, Cisco, GitLab critical flaws under active exploitation
Linux kernel TCP flaw (CVSS 9.8) exploitable via AI-generated payloads; PHP RCE impacting 70% of websites under active attack; Cisco firewalls, GitLab servers targeted via CISA KEV additions with Nov 1 federal deadline.
Volt Typhoon dismantled; PHP RCE active; Microsoft patches 1,400+ flaws
Volt Typhoon's “Silent Train” covert network dismantled after four zero-day campaigns. PHP RCE vulnerabilities affecting 70% of websites under active exploitation. Microsoft releases record 1,400+ patches.
Tailscale SSH, LiteLLM supply-chain, Arista VeloCloud exploits active
Tailscale SSH flaws enable root escalation from compromised devices, LiteLLM master key leak poisoned Python package
Brotli RCE spans Node.js, Python, Bun; Microsoft patches 1,400 flaws; FBI arrests ShinyHunters negotiator
Google's Brotli decoder flaw (CVE-2026-111497) enables RCE across Node.js, Python, Bun, and Envoy proxies. Microsoft released 1,400+ patches. FBI arrested ransomware negotiation firm executive linked to ShinyHunters data theft.
PHP Critical RCEs Under Active Exploitation; BlackX UEFI Bootkit Targets Diplomats
PHP RCE flaws (CVE-2026-109618/109619) actively exploited on ~70% of sites, 400+ patches, Quest Diagnostics confirms patient data breach.
ConnectWise, BeyondTrust, Drupal: Critical exploits, M365 breach, patched RCEs
ConnectWise compromised credential led attackers to compromise 173 Microsoft 365 tenants. BeyondTrust zero-day in active exploitation by Chinese APT. Drupal patches critical RCEs.
ConnectWise breach affects 173 M365 tenants; Drupal RCEs patched; BeyondTrust exploited
ConnectWise Cloud Backup credential stolen; 173 Microsoft 365 environments compromised. Drupal patches two critical RCEs. Candiru spyware delivered via malicious ads. MALFEX npm package distributes shellcode loader.
BeyondTrust zero-day exploited by Chinese APT; Microsoft patches 1,400 flaws; AOMEI supply-chain compromised
Chinese state-backed APT actively exploiting BeyondTrust zero-day (CVE-2026-102764) for espionage; Microsoft released historic 1,400+ patch bundle for Windows; attackers compromised AOMEI Backupper update infrastructure for months.
PwnEscape kernel RCE, Nextcloud backdoors, ShinyHunters arrests
Critical Linux kernel flaw (CVE-2026-99999) allows VMs to read host memory; Nextcloud servers actively backdoored via Collabora RCE; ShinyHunters leadership arrested as remaining members escalate attacks.
Cisco Email Gateway RCE exploited; Nextcloud backdoors; 3 phishing platforms disrupted
Cisco Secure Email Gateway zero-day actively exploited for unauthenticated RCE; Nextcloud servers backdoored via Collabora vulnerability; Microsoft disrupts three phishing platforms behind 1B+ scam messages; U.S. charges 14 in North Korean IT worker fraud ring.
P7 DarkSword iOS exploits escalate; ShinyHunters arrests surge; AI agents targeted in bank breaches
P7 DarkSword iOS variant adds keychain & crypto-wallet theft; multiple ShinyHunters members arrested across three countries; Chinese threat actor exploited Claude AI agents in South Korean bank attacks.
Flax Typhoon infrastructure seized; Cisco NX-OS RCE patches released
FBI-led international coalition seized Flax Typhoon's MicroScan and FishHub hacking tools. Cisco patched critical NX-OS RCE flaws. Android devices ship with Midnight Mimosa firmware malware enabling proxy abuse.
Microsoft, Fortra vulnerabilities patched; Warlock escalates SharePoint attacks on critical infrastructure
Microsoft shipped nearly 1,000 patches; Fortra issued critical BoKS updates; Warlock ransomware escalates SharePoint exploits against water utilities, telecom operators, and government bodies in Portuguese/Spanish-speaking regions.
Fortinet FortiMail zero-day exploited; KillSec ransomware leadership dismantled
Fortinet disclosed critical CVE-2026-104286 in FortiMail under active zero-day exploitation; law enforcement arrested suspected 16-year-old KillSec leader, seized leak site and 110TB of stolen data.
Cisco SD-WAN, Zimbra, Zammad under attack; active exploitation confirmed
Cisco Catalyst SD-WAN Manager zero-day actively exploited for admin access, Zimbra webshell deployments confirmed
France tax breach, Star Blizzard backdoor campaign, Spectre-v2 BTR CPU flaw disclosed
French tax authority breached via stolen staff passwords; 100+ orgs targeted by Russian Star Blizzard with fake event invitations; Spectre-v2 BTR variant leaks Linux memory despite existing defenses.
Citrix NetScaler, Oracle, Cloudflare RCEs under active exploitation; WAF bypasses escalate risks
Two Citrix NetScaler RCE zero-days (CVE-2026-88771, CVE-2026-88772) actively exploited in wild; ShinyHunters gang bypasses WAF rules to resume Oracle PeopleSoft CVE-2026-35273 attacks; Cloudflare fixes cross-tenant container data exposure.
Oracle PeopleSoft, Microsoft patches, Elementor RCE under active exploitation
Oracle PeopleSoft CVE-2026-35273 (CVSS 9.8) under mass exploitation via WAF bypass; ShinyHunters deploying web shells globally. Microsoft released 974 security patches. Lunex stealer abuses AMD drivers to disable EDR and harvest credentials.
Check Point RCE, MikroTik SSH chain, malicious npm/Terraform packages in active exploitation
Check Point VPN gateway (CVE-2026-85102) actively exploited, MikroTik routers compromised via SSH chain, malicious Go malware in HashiCorp Terraform, npm
Check Point, WordPress, Zyxel actively exploited; EvilTokens phishing infrastructure seized
Check Point Security Management Server zero-day (CVE-2026-93616) actively exploited in targeted attacks. WordPress patched critical RCE flaw in v7.1.2. Microsoft disrupted EvilTokens phishing service compromising 12,000+ Microsoft 365 inboxes. Zyxel GS1900 switch exploits targeting government data.
Azure AI, Cisco ISE, WordPress flaws under active exploitation; 23M Gyazo breach
Microsoft patches CVSS 10.0 Azure AI Foundry privilege escalation; Cisco ISE authentication bypass added to CISA KEV; WordPress core flaw forces theme installs; 23.6M Gyazo user records stolen via server vulnerability.
Issabel RCE under active exploitation; Microsoft patches 974 CVEs; browser AI assistants hijacked
Issabel Framework vulnerability CVE-2026-89026 (CVSS 9.8) actively exploited for unauthenticated OS command execution. Microsoft issued record 974-CVE patch batch including critical flaws. Browser extension attack hijacks AI assistants across Chrome, Edge, and Claude.
Hardware attack breaks Intel/AMD confidential computing; Gitea RCE exploited across six countries
DDRop hardware attack undermines Intel TDX and AMD SEV-SNP confidential computing. Japan's Digital Agency confirms VPN breach of 246K personnel records. Red Heron exploits Gitea RCE to compromise 13 organizations across six countries.
Check Point VPN & Tencent flaws in active exploitation; RubyGems RCE confirmed
Critical Check Point VPN flaws face imminent exploitation; Tencent Input Method vulnerability deployed for GrayRabbit malware; OpenAI agents linked to May RubyGems RCE campaign gaining server access.
Microsoft 974 patches, GitLab CVSS 10 exploited, Russia weaponizes Claude
Microsoft released 974 patches (largest batch ever); GitLab CVSS 10 flaw exploited within hours; Anthropic disrupted seven China-based labs running Claude distillation attacks and separately detected Russia-linked espionage targeting 20+ government entities.
Critical RCEs in Switchvox, WordPress plugins; Windows Defender disablement campaign
malware campaign disables Windows Defender. Four AI coding agent vulnerabilities remain unpatched.
TerminalFix backdoor, WordPress plugin RCEs, PaperCut chain exploit
TerminalFix ClickFix variant hijacks Windows Terminal to deploy reverse-tunnel backdoor; WordPress plugins (WPMU DEV, Avada, TranslatePress, Pods, GiveWP) patched for critical auth bypass and RCE; PaperCut NG/MF actively exploited via chained flaws.
WordPress plugin RCEs, Linux kernel exploit, PaperCut bypass patch; Cosmos EVM drained
Five critical WordPress plugin flaws enable RCE; Linux kernel CVE-2026-53362 exploited by OpenAI agents (CISA KEV, deadline Aug 30); PaperCut issues second emergency patch after bypass discovery; Cosmos EVM drained across six blockchains; Berlin refuses extortion demand.
PaperCut second patch; Cosmos EVM drained; McKesson 284M records stolen
PaperCut releases second emergency patch after first fixes bypassed; Cosmos EVM exploited across six blockchains; McKesson discloses theft of 284M patient records by ShinyHunters extortion group.
Chinese infrastructure disrupted; Kaltura RCE unpatched; NovaCookies targets Microsoft 365
$320/month subscription model.
Mirage2FA hits 4,500 orgs; Oracle Weblogic RCE, NVIDIA AI poisoning, WordPress plugin flaws
Mirage2FA phishing toolkit has compromised 4,500 US/EU organizations via Microsoft 365 spoofing; Oracle Weblogic Server vulnerability (CVE-2026-21962) added to CISA KEV with 3-day patch deadline; NVIDIA NemoClaw vulnerable to unauthenticated model poisoning.
Rust supply-chain attack, Microsoft patches 398 flaws, Siemens PLCs targeted by AI-generated exploits
Rust crate supply-chain poisoning (245M downloads); Russian cyber espionage hijacking OAuth accounts; Microsoft patches 398 flaws including active exploitation; AI-generated Siemens PLC exploits target U.S. critical infrastructure.
Microsoft, VMware, Apple vulnerabilities actively exploited; CISA KEV additions demand immediate patching
CISA added four actively exploited vulnerabilities affecting Microsoft IKE, VMware vCenter, SharePoint, Dahua devices compromised en masse, and healthcare breaches expose millions.
GitLab, Forminator WordPress, Azure breach: Critical RCEs and 3.6M records stolen
GitLab patched critical GraphQL flaw; Forminator WordPress plugin RCE affects 600K+ sites; threat actor claims 3.6M Azure account records stolen from Fortune 500 companies.
SharePoint, Windows zero-day exploited; Lazarus backdoor in defense sector
SharePoint CVE-2026-55040 (CVSS 9.1) under active exploitation; Lazarus deploys Windows zero-day backdoor targeting defense/aerospace in France, Germany, Brazil, India; 737 malicious Chrome VPN extensions intercept traffic.
SharePoint auth bypass exploited; 737 Chrome VPN extensions abused; Microsoft patches 398 flaws
737 malicious Chrome VPN extensions intercepting browser traffic targeting Russian speakers. Microsoft released 398 patches including one zero-day in active exploitation.
Kimsuky's AI warfare, StormEncryptor ransomware, water infrastructure targeted by Iran
Kimsuky deploys offline AI for phishing and malware automation; StormEncryptor emerges from Medusa affiliate; Iran-linked actors target 12+ U.S. water systems via exposed PLCs.
Linux KVM escape, Cisco SD-WAN patches, Spectre v2 defenses bypassed
Zapscape KVM vulnerability allows privileged guest escape on Linux hosts; Cisco patches 12 SD-WAN/IOS XE flaws including three 9.8 CVSS bugs; researchers bypass Spectre v2 mitigations via interrupt injection.
IBM Langflow, Apache Tomcat, N-able RCE and auth bypass actively exploited
CISA designated IBM Langflow (unauthenticated RCE), Apache Tomcat (encryption bypass), and N-able N-central (auth bypass) as actively exploited with federal remediation deadlines. Snowflake attacker pleads guilty to 165-organization breach; Ransom Cartel creator sentenced 16 years.
Zimbra zero-day exploited by Laundry Bear; Langflow RCE added to KEV
Russian state-sponsored group Laundry Bear exploits Zimbra zero-click vulnerability to steal emails and 2FA codes. new CVEs added to CISA KEV including Langflow RCE and WordPress SQL injection chains.
Ubuntu, WordPress, Adobe critical flaws under active exploitation; CISA KEV adds four CVEs
Ubuntu snap-confine LPE (CVE-2026-8933), Adobe Acrobat extension WhatsApp hijacking, and Windmill path traversal actively exploited. CISA adds four KEV flaws
NGINX, WordPress, SonicWall RCEs under active exploitation; patched versions released
NGINX CVE-2026-42533 heap buffer overflow patched July 15; WordPress wp2shell RCE now public; SonicWall SMA zero-days actively exploited by Inc ransomware; Russian APT UAC-0145 deploying ClickFix malware in Ukraine.
Scattered Spider sentenced; Microsoft patches record 570 flaws; macOS ClickLock stealer active
Two Scattered Spider members sentenced to 5.5 years for 2024 Transport for London attack. Microsoft releases record 570-CVE patch set. ClickLock macOS malware terminates apps until password stolen.
Microsoft SharePoint, Windows zero-days actively exploited; Zoom account takeover critical
Microsoft SharePoint Server missing authentication flaw actively exploited; Windows User Profile Service zero-day PoC released; Zoom critical account takeover vulnerability disclosed. Microsoft patched record 570 flaws in latest Patch Tuesday.
Adobe ColdFusion RCE, Linux KVM escape, Gitea authentication bypass under active attack
Adobe ColdFusion max-severity RCE actively exploited; Linux KVM escape (CVE-2026-53359) affects Intel/AMD hosts; Gitea Docker auth bypass (CVE-2026-20896, CVSS 9.8) probed within 13 days; Iranian MOIS-linked group deploys new Cavern C2 framework against Israeli IT providers.
North Korea PolinRider expands to 108 packages; Avalon ransomware framework emerges
North Korean actors publish 108 malicious packages across npm, Packagist, Go, Chrome; Avalon modular framework combines credential theft with CrownX ransomware. U.S. government paid $1M extortion to Kairos group.
Unpatched Argo CD RCE, ChocoPoC researcher targeting, Scattered Spider extraditions
Unpatched Argo CD repo-server RCE enables full Kubernetes cluster takeover; weaponized GitHub PoCs deliver ChocoPoC RAT targeting security researchers; Scattered Spider leadership faces extradition and guilty pleas; DHS HSIN platform breached; Kubota confirms month-long network access.
Oracle PeopleSoft breaches widen; malicious Chrome extension steals searches; Mustang Panda targets India
Oracle PeopleSoft zero-day exploited at Nissan and NAIC; malicious Chrome extension intercepted searches and address bar input; Mustang Panda uses Zoho WorkDrive in Indian government campaigns.
Russian intel evolves Signal phishing; Cisco actively exploited; KDDI breach hits 14.2M
Russian intelligence phishing campaign now targets Signal backup recovery keys; Cisco vulnerability under active exploitation with CISA emergency deadline; KDDI email breach exposes 14.2M credentials across six ISPs.
Russian phishing escalates; Turla malware evolves; GitHub AI agents at risk
Russian intelligence expanding Signal phishing to steal backup keys; Turla deploys StockStay malware against Ukraine; AI coding agents tricked into executing malware via GitHub repositories.
Signal backup keys targeted; Linux kernel RCE; AWS Q credential theft
Russian intelligence phishing now targets Signal Backup Recovery Keys. Linux kernel privilege escalation (CVE-2026-46331) has working exploit. AWS Q flaw (CVE-2026-12957, CVSS 8.5) allows malicious repos to steal cloud credentials.
Critical Lantronix flaw actively exploited; Cisco SD-WAN zero-day; 27M credentials recovered
Lantronix EDS5000 critical flaw in active exploitation; CISA mandates patching by June 26. Amadey/StealC malware networks dismantled, 27M credentials recovered. Cordyceps CI/CD weakness affects 300+ GitHub repositories.
Apple A12/A13 unpatchable exploit; Gentlemen RaaS doubles EDR killers; Fortinet FortiBleed escalates
Apple A12/A13 SecureROM exploited with unpatchable code execution; Gentlemen RaaS expands EDR-evasion toolkit targeting 400 processes; Fortinet FortiBleed now hits 86,644 devices. Klue OAuth breach spreads Salesforce credential theft to cybersecurity vendors.
Splunk RCE, Arch Linux supply-chain hijack, Velvet Ant decade-long backdoor
Splunk Enterprise CVE-2026-20253 (CVSS 9.8) enables unauthenticated RCE; 400+ Arch Linux AUR packages hijacked with infostealer/rootkit; China-linked Velvet Ant maintained decade-long PAM/OpenSSH backdoor.
Microsoft 200-patch record, Veeam RCE critical, GitHub supply-chain worm ongoing
Microsoft released record 200 Patch Tuesday fixes including critical flaws; Veeam Backup & Replication RCE (CVE-2026-44963, CVSS 9.4) requires immediate patching; 73 GitHub repos remain compromised as Miasma supply-chain attack investigation continues.
Miasma worm hits Microsoft GitHub, SolarWinds Serv-U actively exploited, WordPress Everest Forms RCE
Miasma worm compromises 73 Microsoft GitHub repositories; SolarWinds Serv-U DoS flaw confirmed actively exploited; WordPress Everest Forms Pro critical RCE under active attack; Meta AI bot abused to reset Instagram accounts.
Miasma worm hits Microsoft GitHub; SolarWinds actively exploited; Chrome 429 patches
Microsoft GitHub hit by Miasma self-replicating worm across 73 repositories; SolarWinds Serv-U actively exploited for DoS; Chrome 149 patches record 429 vulnerabilities.
Cisco Unified CM RCE, Claude GitHub Action Hijack, AI Agent Exploits
Cisco patches critical Unified CM RCE with public PoC; Claude Code GitHub Action flaw enables repository hijack via GitHub issues; AI agents exploited in defense networks; Hola Browser compromised with cryptominer.
Android, WinRAR, WordPress Kirki: Three critical zero-days under active exploitation
Google Android zero-day (CVE-2025-48595) actively exploited; Gamaredon APT weaponizing WinRAR; WordPress Kirki plugin hijacking admin accounts. CISA adds Oracle WebLogic to KEV catalog.
Red Hat npm, WordPress, Instagram under active attack; critical Windows vulnerability patching urgent
Red Hat npm packages compromised with Miasma credential-stealing worm; WordPress RCE via CVE-2026-8732; Instagram accounts hijacked via Meta AI bot exploit. Patch WP Maps Pro immediately, rotate developer credentials, enable MFA.
PAN-OS GlobalProtect actively exploited; Russian infrastructure dismantled; Linux kernel flaw
Palo Alto PAN-OS GlobalProtect authentication bypass (CVE-2026-0257) actively exploited; Dutch authorities arrest two hosting operators supporting Russian cyberattacks; Linux kernel CIFSwitch flaw allows privilege escalation.
Active exploits: Palo Alto GlobalProtect, CISA credential leak, Linux kernel RCE
Palo Alto PAN-OS GlobalProtect flaw (CVE-2026-0257) under active exploitation; CISA contractor exposed AWS GovCloud keys on GitHub; Linux kernel CIFSwitch privilege escalation disclosed.
FortiClient EMS, GitHub secrets, CISA breach: critical exploitation ongoing
FortiClient EMS actively exploited to deploy credential stealer; CISA contractor leaked AWS GovCloud keys on GitHub; BTMOB Android RAT spreading via phishing with builder interface.
FortiClient EMS, Gogs RCE actively exploited; CISA GitHub leak exposes AWS keys
FortiClient EMS and Gogs RCE vulnerabilities actively exploited in the wild. CISA contractor exposed AWS GovCloud credentials on GitHub. FIFA World Cup fraud campaigns register 4,300+ malicious domains.
Critical RCEs and credential leaks: Microsoft SharePoint, CISA AWS exposure, MuddyWater espionage
Microsoft patched SharePoint RCE (CVE-2026-45659); CISA contractor exposed AWS GovCloud keys on GitHub; MuddyWater targeted nine organizations across four continents using DLL side-loading.
GitHub npm supply chain attacks, LiteSpeed RCE, CISA credentials exposed
Supply-chain attacks hit npm and Composer ecosystems; LiteSpeed cPanel CVE-2026-48172 actively exploited; CISA contractor exposed AWS GovCloud credentials on GitHub.
GitHub supply-chain attack, Drupal RCE, AWS GovCloud credential leak
GitHub campaign injects malware into 5,561 repos; Drupal SQL injection actively exploited; CISA contractor exposes AWS GovCloud credentials.
Critical RCEs: Microsoft Defender, Linux kernel, Cisco Workload; Showboat targets telcos
Microsoft Defender vulnerabilities actively exploited; 9-year-old Linux kernel flaw enables root execution; Cisco Workload max-severity RCE patched; Showboat malware targets telcos across Middle East and Central Asia.
Microsoft, Drupal, Linux critical patches; OAuth phishing bypasses MFA on 340+ orgs
Microsoft disrupted Fox Tempest malware-signing service; Drupal critical patches May 20; OAuth phishing bypasses MFA on 340+ Microsoft 365 organizations. CVE-2026-31635 Linux PoC public.
Zero-days exploited: NGINX, MS Exchange, Cisco SD-WAN; TanStack hit
Critical zero-days in NGINX, Microsoft Exchange, and Cisco SD-WAN actively exploited in the wild. TanStack supply chain attack compromises OpenAI and AI companies. Immediate patching required.
Critical RCEs exploited: Cisco SD-WAN, Exchange, Funnel Builder
Critical vulnerabilities in Cisco SD-WAN (CVSS 10.0), Microsoft Exchange, and Funnel Builder WordPress plugin under active exploitation. Supply chain attacks compromise npm packages. Immediate patching required.
MS Exchange zero-day exploited; npm hits OpenAI; Turla evolves Kazuar
Critical Microsoft Exchange zero-day exploited in wild; npm supply chain attacks compromise OpenAI; Turla APT evolves Kazuar into P2P botnet; WordPress plugins actively harvesting payment cards.
Cisco SD-WAN zero-day exploited; TanStack supply-chain hits OpenAI
Critical Cisco SD-WAN zero-day exploited in the wild; supply chain attacks compromise TanStack and node-ipc; state APTs target government; education platform disrupted by extortion.
vm2, Palo Alto, DAEMON Tools exploited; Iran APT false-flag operations
Critical vulnerabilities in vm2, Palo Alto firewalls, and DAEMON Tools combined with Russian military intelligence token harvesting and Iranian APT false-flag campaigns demand immediate patching and investigation.
Apache HTTP/2 & MetInfo exploited; DAEMON Tools supply-chain hit
Critical vulnerabilities in Apache HTTP/2 and MetInfo CMS, supply-chain compromise of DAEMON Tools, and persistent OAuth backdoors require immediate response.
Linux root vulnerability in KEV; cPanel mass-exploitation continues
Critical Linux root access vulnerability added to CISA KEV with active exploitation confirmed. Multiple critical threats including cPanel mass-exploitation, source code breaches, and state-sponsored APT campaigns.
cPanel RCE ransomware; 30K Facebook hacked; Trellix source leaked
Critical cPanel RCE exploited for ransomware; Russian military harvesting Office tokens; 30K Facebook accounts compromised; Trellix source code breached; automated Azure OAuth attacks.
cPanel auth bypass; state token harvesting; SaaS extortion attacks
Critical vulnerabilities, state-sponsored token harvesting, large-scale phishing operations, and coordinated SaaS extortion attacks demand immediate defensive action across government and technology sectors.
PyTorch Lightning & SAP supply-chain; AI cuts attack time to 24h
Critical supply chain attacks compromise PyTorch Lightning and SAP packages; Russian state-sponsored actors steal Office tokens; AI-accelerated exploitation shrinks time-to-compromise to 24 hours.
Developer platform supply-chain attacks; Windows RPC zero-day
Critical supply chain attacks on developer platforms, Russian state-sponsored token theft via router exploits, and unpatched Windows RPC privilege escalation demand immediate defensive action.
FIRESTARTER federal Cisco persistence; Chinese APT GopherWhisper
Critical threats include FIRESTARTER backdoor persistence on federal Cisco devices, Russian military token theft via router exploitation, Chinese APT GopherWhisper attacks, and four actively exploited CISA KEV vulnerabilities with May 2026 federal patching deadline.
FIRESTARTER on federal Cisco gear; 4 critical CVEs added to CISA KEV
FIRESTARTER backdoor persists on federal Cisco infrastructure despite patches; Russian state actors harvesting Office tokens via router exploits; four critical CVEs added to CISA KEV with May 2026 deadline; APT campaigns targeting U.S. defense sector; AI-powered phishing escalates to personalized 1-to-1 attacks.
FIRESTARTER persists on federal Cisco; APT spear-phishes NASA
FIRESTARTER backdoor persists on federal Cisco infrastructure despite patches. Russian military intelligence harvesting Office tokens via router exploits. Chinese APT targeting NASA and defense sector with spear-phishing. AI-powered phishing and FakeWallet credential theft escalating.
Bitwarden CLI & Checkmarx compromised; Russian Office 365 token theft
Critical supply-chain compromises affecting Bitwarden CLI and Checkmarx tools; Russian state actors harvesting Office 365 tokens; AI-powered attacks outpacing human response capabilities.
Russian APT token theft; Gentlemen ransomware claims 1,570 victims
Russian state-backed APT harvesting Microsoft tokens, 1,570+ Gentlemen ransomware victims, critical SD-WAN and RMM exploits, Windows Defender flaws—urgent patching required across infrastructure.
SGLang & Anthropic MCP RCE; APT campaigns hit OT/healthcare auth
Critical RCE vulnerabilities in AI infrastructure (SGLang, Anthropic MCP) combined with state-sponsored APT campaigns targeting authentication systems and OT/healthcare infrastructure demand immediate patching and access controls.
Defender zero-day; protobuf.js RCE; APT28 hits Ukrainian government
Critical Microsoft Defender zero-days actively exploited, 68% of cloud breaches from unmanaged service accounts, Russian state actors harvesting Office tokens, protobuf.js RCE with public exploit, APT28 targeting Ukrainian government.
Microsoft Defender zero-days; 68% cloud breaches from ghost identities
Critical Microsoft Defender zero-days under active exploitation, 68% of cloud breaches from unmanaged service accounts, and Russian state-sponsored token harvesting campaigns demand immediate action.
Apache ActiveMQ exploited; Defender zero-day; ZionSiphon hits water
Apache ActiveMQ actively exploited; Microsoft Defender zero-day disclosed; Russian state actors harvesting Office 365 tokens; ZionSiphon targets water infrastructure.
nginx-ui auth bypass exploited; SharePoint zero-day in 169 patches
Critical nginx-ui authentication bypass actively exploited; Microsoft releases 169 patches including SharePoint zero-day; n8n webhooks weaponized for phishing; WordPress plugins and signed software compromised.
Microsoft zero-days exploited; Mirax RAT hits 220K; PHP supply chain
Critical Microsoft zero-days under exploitation, Russian state hackers harvesting Office tokens via routers, and 220K users compromised by Mirax RAT. Supply-chain risks escalating across PHP and development ecosystems.
Adobe zero-day exploited; APT37 attacks; AI-powered exploitation
Critical Adobe zero-day under active exploitation, Russian state-sponsored token harvesting, and APT37 social engineering campaigns compound with AI-powered vulnerability discovery threats.
Adobe Reader zero-day; CPUID STX RAT supply-chain; Iran hits 4,000 ICS
Critical Adobe Reader zero-day, CPUID supply-chain compromise distributing STX RAT, Russian APT harvesting Office tokens via router exploits, and Iranian actors targeting 4,000+ U.S. industrial control systems.
Marimo RCE exploited; Iran targets 4,000 US PLCs; Russian token theft
Critical exploitation of Marimo RCE, Iranian targeting of 4,000 US PLCs, and Russian token harvesting via routers demand immediate patching and access controls.
APT28 PRISMEX on NATO; ActiveMQ 13-yr RCE; Russian router token theft
APT28 deploys PRISMEX malware targeting NATO allies; 13-year-old ActiveMQ RCE and Russian router-based token theft critical; new botnets and healthcare ransomware disruptions.
APT28 DNS hijack via routers; Iran hits PLCs; Docker RCE
Russian APT28 conducting large-scale DNS hijacking via compromised routers for token theft; Iranian hackers targeting U.S. critical infrastructure PLCs; critical Docker and Flowise vulnerabilities under active exploitation.
Iran & DPRK target Microsoft 365; GitHub C2 supply-chain attacks
State-sponsored APT campaigns targeting Microsoft 365 and supply chains escalate with GitHub C2 usage and zero-day exploits deployed within 24 hours of breach.
TA416 PlugX on EU govts; UNC1069 Axios npm; device code phishing 37x
Nation-state campaigns targeting European governments and supply chain infrastructure. TA416 resumes targeting with PlugX. North Korean UNC1069 compromises Axios npm. Device code phishing surges 37x.
TrueConf zero-day; TA416 hits EU govts; UNC1069 npm compromise
Critical zero-day in TrueConf, resurgent Chinese APT targeting European governments, North Korean npm supply chain compromise, and third-party vendor breaches require immediate response
Chrome & TrueConf zero-days exploited; widespread malware campaigns
Critical zero-day vulnerabilities in Chrome and TrueConf under active exploitation, combined with widespread malware campaigns targeting mobile and enterprise infrastructure.
TrueConf zero-day exploited; North Korea Axios npm compromise
Critical zero-day exploits in TrueConf and North Korean Axios compromise, plus wiper attacks and AI platform over-privilege vulnerabilities demand immediate response across cloud, government, and healthcare sectors.
Citrix exploited; Axios npm RAT supply-chain; OpenAI data theft
Critical Citrix vulnerability actively exploited, Axios npm supply chain attack spreading RAT, OpenAI vulnerabilities enabling data theft, state-sponsored APT operations escalating against telecom and healthcare sectors
FBI Director email breached; Citrix & F5 zero-days exploited
FBI Director's email breached by Iran-linked hackers; critical Citrix and F5 vulnerabilities under active exploitation; wiper attacks target Stryker; nation-state exploit kits leaked publicly.
Iran breaches FBI Director email; Citrix & F5 zero-days unpatched
Iran-linked actors breached FBI Director Kash Patel's email and launched wiper attacks on Stryker. Critical Citrix and F5 vulnerabilities under active exploitation with no patches available.
Chinese APT in telecom backbone; Langflow zero-day exploited
State-sponsored Chinese APT embedded in telecom backbone, critical Langflow AI vulnerability actively exploited, wiper malware targeting Iran systems, and zero-click AI assistant vulnerabilities require immediate response.
AI autonomous espionage; device code phishing at 340+ orgs
AI-powered autonomous cyber espionage, device code phishing at 340+ organizations, and critical infrastructure vulnerabilities require immediate defensive action across all sectors.
Russian phishing on Signal/WhatsApp; Oracle RCE exploited
Russian intelligence conducting mass Signal/WhatsApp phishing; critical Oracle RCE vulnerability; Trivy supply-chain attack spreads CanisterWorm across 47+ npm packages; VoidStealer bypasses Chrome encryption; Iran-backed wiper attacks on medical technology.
Vulnerability Reports
Vulnerability Report – Week 3 of October 2026
This week's highest-priority vulnerabilities are two actively exploited critical flaws in Collabora Online and Arista VeloCloud, both added to CISA's Known Exploited Vulnerabilities catalog. organizat
Vulnerability Report – Week 2 of October 2026
This week's verified threats center on two critical vulnerabilities: CVE-2026-102764 affecting BeyondTrust Remote Support, which has been actively exploited by state-backed threat actors for zero-day
Vulnerability Report – Week 4 of September 2026
This week's threat landscape is dominated by active exploitation of Microsoft SharePoint vulnerabilities by the China-linked Warlock ransomware group targeting critical infrastructure, government, and
Vulnerability Report – Week 3 of September 2026
Two CVEs with active exploitation corroborated across multiple sources demand immediate attention this week. CVE-2026-35273 (Oracle PeopleSoft) is being weaponized by ShinyHunters using WAF-bypass tec
Vulnerability Report – Week 2 of September 2026
This week saw four verified CVEs with explicit IDs and actionable intelligence. and require immediate patching. Two additional critical flaws affecting SolarWinds ARM and Orkes Conductor show high CVS
Vulnerability Report – Week 5 of August 2026
with CVE-2026-59346 (VMware) and. Organizations should prioritize patching VMware Workstation/Fusion, PaperCut authentication/RCE chains in education, and PostgreSQL logical decoding flaw, while monit
Vulnerability Report – Week 4 of August 2026
This week saw three confirmed critical vulnerabilities with active exploitation: CVE-2023-49105 (ownCloud) was added to CISA's Known Exploited Vulnerabilities catalog after targeting a nuclear researc
Vulnerability Report – Week 3 of August 2026
This week saw multiple CVEs added to CISA's Known Exploited Vulnerabilities catalog with confirmed active exploitation, including CVE-2026-73570, CVE-2026-72529, CVE-2026-64849, and CVE-2026-33824. Ad
Vulnerability Report – Week 2 of August 2026
Three critical vulnerabilities require immediate attention this week. CVE-2026-55040 (Microsoft SharePoint) and CVE-2026-59310 (VMware vCenter) are confirmed under active exploitation following PoC re
Vulnerability Report – Week 1 of August 2026
CVE-2026-8037 in Progress Kemp LoadMaster represents a critical command injection flaw with 792+ reported exploit attempts. Organizations should prioritize patching known exploited vulnerabilities and
Vulnerability Report – Week 4 of July 2026
This week's verified vulnerability landscape is dominated by a critical Adobe Campaign Classic flaw (CVSS 10.0) requiring immediate patching. Chrome and Rails patches addressed hundreds of flaws in ag
Vulnerability Report – Week 4 of June 2026
This week features three verified CVEs with explicit IDs across kernel, development tools, and enterprise systems. CVE-2026-46331 (Linux pedit) poses immediate risk to local systems with a public expl
Vulnerability Report – Week 1 of June 2026
Three verified CVEs dominated this week's reporting: one actively exploited Linux kernel vulnerability (CVE-2022-0492) now in CISA's Known Exploited Vulnerabilities catalog, one proof-of-concept relea
Vulnerability Report – Week 3 of May 2026
This week presents an exceptionally high-risk threat landscape with multiple critical vulnerabilities under active exploitation across infrastructure, enterprise, and open-source ecosystems. Immediate
Vulnerability Report – Week 2 of May 2026
This week marks a significant surge in actively exploited vulnerabilities, with three critical flaws requiring immediate patching across IT infrastructure and OT systems. The Ollama out-of-bounds read
Vulnerability Report – Week 1 of May 2026
This week presents an exceptionally high-risk threat landscape dominated by active exploitation campaigns and critical infrastructure vulnerabilities. Federal agencies face an immediate Sunday deadlin
Vulnerability Report – Week 4 of April 2026
This week presents elevated risk from actively exploited vulnerabilities across network infrastructure, IoT devices, and enterprise software. Immediate patching is required for Cisco Firepower/ASA dev
Vulnerability Report – Week 3 of April 2026
This week presents elevated risk across OT/ICS sectors with multiple critical RCE vulnerabilities in industrial control systems and emerging threats to cloud infrastructure. Active exploitation of Mic
Vulnerability Report – Week 2 of April 2026
This week presents an elevated threat landscape dominated by actively exploited critical vulnerabilities in both IT and OT environments. Iranian-affiliated threat actors are actively targeting US crit
Vulnerability Report – Week 1 of April 2026
This week presents elevated risk with five critical vulnerabilities actively exploited in the wild, including FortiClient EMS and video conferencing systems requiring immediate patching. Organizations
Vulnerability Report – Week 5 of March 2026
This week reflects sustained critical threats across OT/ICS and enterprise systems with multiple actively exploited vulnerabilities. F5 BIG-IP APM (CVE-2025-53521) and Citrix NetScaler (CVE-2026-3055)
Vulnerability Report – Week 3 of March 2026
This week demands immediate attention. Two actively exploited vulnerabilities (VMware ESXi and FortiOS) require emergency patching. Organizations using Windows Server should prioritize the kernel priv