Healthcare Industry Intelligence

Healthcare organizations face uniquely high-stakes cybersecurity threats. Patient data carries premium value on criminal markets, ransomware attacks can directly endanger lives by disrupting clinical systems, and regulatory requirements under HIPAA create complex compliance obligations. defend.network tracks threats specifically targeting hospitals, health systems, medical device manufacturers, and pharmaceutical companies.

Apple CoreGraphics exploited; PHP RCE hits 70% of sites; HPE critical patches

Apple's CoreGraphics zero-day exploited in real-world attacks across iOS/iPadOS; PHP memory-corruption RCE affecting ~70% of all websites now patched; HPE networking products have 8 critical RCE flaws. Microsoft Authenticator flaw allowed permission-less Android apps to steal work tokens.

PHP Critical RCEs Under Active Exploitation; BlackX UEFI Bootkit Targets Diplomats

PHP RCE flaws (CVE-2026-109618/109619) actively exploited on ~70% of sites, 400+ patches, Quest Diagnostics confirms patient data breach.

WordPress Bricksforge & SonicWall SMA CVSS 10.0 exploits; Ledger spy chips drain wallets

Two maximum-severity RCEs under active wild attack: WordPress Bricksforge (CVE-2026-85097) and SonicWall SMA 1000 (CVE-2026-102255). Ledger hardware wallets via CryptoBilis reseller contain spy chips; 360K+ iRhythm patients affected by data breach.

Rejetto HFS, MS Exchange, Dell System Update under active exploitation

Rejetto HFS vulnerability (CVE-2026-61500) actively scanned; Microsoft Exchange flaw permits privilege escalation; Dell DSU tool flaws enable root access. Denmark population breach affects 8.8M people.

Critical RCEs in Cisco Nexus, HPE ArubaOS; infrastructure compromises escalate

Cisco patches critical Nexus 9000 unauthenticated RCE affecting 10 Silicon One switches; HPE releases 8 CVEs in ArubaOS-CX. Coder's Cloudflare infrastructure hijacked to distribute malicious Terraform modules. 153M+ driver licenses offered on dark web.

JFrog Artifactory, Langflow critical flaws exploited; TeamPCP arrested

JFrog Artifactory CVE-2026-82329 (CVSS 9.8) exploited to mint admin tokens; Langflow CVE-2026-0768 RCE active for API key theft. Two alleged TeamPCP supply-chain attackers arrested in Australia. iOS spyware campaign harvesting wallet seeds.

Kaspersky, Microsoft, Anthropic hit by infostealers; ransomware escalates AI tools

Infostealer malware targets Anthropic and Microsoft users; Aurora ransomware gang deploys Cursor AI; North Korean threat actors expand beyond IT into healthcare and sales.

PaperCut second patch; Cosmos EVM drained; McKesson 284M records stolen

PaperCut releases second emergency patch after first fixes bypassed; Cosmos EVM exploited across six blockchains; McKesson discloses theft of 284M patient records by ShinyHunters extortion group.

Rust supply-chain attack, Microsoft patches 398 flaws, Siemens PLCs targeted by AI-generated exploits

Rust crate supply-chain poisoning (245M downloads); Russian cyber espionage hijacking OAuth accounts; Microsoft patches 398 flaws including active exploitation; AI-generated Siemens PLC exploits target U.S. critical infrastructure.

Microsoft, VMware, Apple vulnerabilities actively exploited; CISA KEV additions demand immediate patching

CISA added four actively exploited vulnerabilities affecting Microsoft IKE, VMware vCenter, SharePoint, Dahua devices compromised en masse, and healthcare breaches expose millions.

Chrome patches 1,442 flaws; HollowFrame targets law firms; Amgen breach confirmed

Google patches 1,442 Chrome flaws across three releases. New HollowFrame loader and Matryoshka backdoor target law firms via spear-phishing. Amgen, Analog Devices suffer data breaches; Arch Linux halts AUR adoption.

WordPress, 7-Zip RCE exploited; NadMesh steals AWS keys; ACR Stealer surge

WordPress wp2shell RCE under active exploitation with public PoC. NadMesh botnet harvests 3,811 AWS keys from exposed AI services. 7-Zip patches critical archive RCE. Microsoft alerts on ACR Stealer surge.

FBI Director email breached; Citrix & F5 zero-days exploited

FBI Director's email breached by Iran-linked hackers; critical Citrix and F5 vulnerabilities under active exploitation; wiper attacks target Stryker; nation-state exploit kits leaked publicly.

Iran breaches FBI Director email; Citrix & F5 zero-days unpatched

Iran-linked actors breached FBI Director Kash Patel's email and launched wiper attacks on Stryker. Critical Citrix and F5 vulnerabilities under active exploitation with no patches available.

Telnyx PyPI compromise; iOS exploit active; APT hits telecom

Critical supply-chain compromise of Telnyx PyPI package, active iOS exploitation, state-sponsored wiper attacks on medical device firm, and advanced APT malware targeting telecom infrastructure demand immediate response.

LiteLLM supply-chain compromise; wiper hits medical device firm

Critical supply chain attacks on LiteLLM and development tools, wiper attacks on medical device manufacturer, and RCE vulnerabilities in manufacturing systems demand immediate response.

Trivy & VS Code supply-chain breach; Iran wipers hit Kubernetes

Critical supply chain attacks on Trivy scanner and VS Code, destructive Iran-linked wipers targeting Kubernetes, and phishing-as-a-service platforms resurging with 29K IRS victims. Initial access now occurs in 22 seconds.

VMware ESXi ransomware exploit; BlackSuit healthcare breach

Critical VMware ESXi vulnerability actively exploited by ransomware operators. BlackSuit group claims major U.S. healthcare breach. CISA adds 3 new CVEs. Microsoft patches Windows kernel zero-day. New PhishRelay kit enables real-time MFA bypass.

Vulnerability Report – Week 3 of September 2026

Two CVEs with active exploitation corroborated across multiple sources demand immediate attention this week. CVE-2026-35273 (Oracle PeopleSoft) is being weaponized by ShinyHunters using WAF-bypass tec

Vulnerability Report – Week 2 of August 2026

Three critical vulnerabilities require immediate attention this week. CVE-2026-55040 (Microsoft SharePoint) and CVE-2026-59310 (VMware vCenter) are confirmed under active exploitation following PoC re

Vulnerability Report – Week 1 of August 2026

CVE-2026-8037 in Progress Kemp LoadMaster represents a critical command injection flaw with 792+ reported exploit attempts. Organizations should prioritize patching known exploited vulnerabilities and

Vulnerability Report – Week 5 of June 2026

This week's verified CVE activity is light, with only two explicitly identified vulnerabilities in the source material. The most urgent priority is CVE-2026-45659, which CISA reports as actively explo

Vulnerability Report – Week 4 of June 2026

This week features three verified CVEs with explicit IDs across kernel, development tools, and enterprise systems. CVE-2026-46331 (Linux pedit) poses immediate risk to local systems with a public expl

Vulnerability Report – Week 3 of June 2026

This week's verifiable vulnerability landscape is limited to two explicitly identified CVEs. and should be treated as actively exploited. CVE-2026-4020 affecting the Gravity SMTP WordPress plugin is b

Vulnerability Report – Week 3 of May 2026

This week presents an exceptionally high-risk threat landscape with multiple critical vulnerabilities under active exploitation across infrastructure, enterprise, and open-source ecosystems. Immediate

Vulnerability Report – Week 2 of May 2026

This week marks a significant surge in actively exploited vulnerabilities, with three critical flaws requiring immediate patching across IT infrastructure and OT systems. The Ollama out-of-bounds read

Vulnerability Report – Week 1 of May 2026

This week presents an exceptionally high-risk threat landscape dominated by active exploitation campaigns and critical infrastructure vulnerabilities. Federal agencies face an immediate Sunday deadlin

Vulnerability Report – Week 4 of April 2026

This week presents elevated risk from actively exploited vulnerabilities across network infrastructure, IoT devices, and enterprise software. Immediate patching is required for Cisco Firepower/ASA dev

Vulnerability Report – Week 3 of April 2026

This week presents elevated risk across OT/ICS sectors with multiple critical RCE vulnerabilities in industrial control systems and emerging threats to cloud infrastructure. Active exploitation of Mic

Vulnerability Report – Week 2 of April 2026

This week presents an elevated threat landscape dominated by actively exploited critical vulnerabilities in both IT and OT environments. Iranian-affiliated threat actors are actively targeting US crit

Vulnerability Report – Week 1 of April 2026

This week presents elevated risk with five critical vulnerabilities actively exploited in the wild, including FortiClient EMS and video conferencing systems requiring immediate patching. Organizations

Vulnerability Report – Week 5 of March 2026

This week reflects sustained critical threats across OT/ICS and enterprise systems with multiple actively exploited vulnerabilities. F5 BIG-IP APM (CVE-2025-53521) and Citrix NetScaler (CVE-2026-3055)

Vulnerability Report – Week 3 of March 2026

This week demands immediate attention. Two actively exploited vulnerabilities (VMware ESXi and FortiOS) require emergency patching. Organizations using Windows Server should prioritize the kernel priv