Telecom Industry Intelligence

Telecommunications providers are critical infrastructure targets whose compromise can enable surveillance, disrupt communications, and provide access to vast quantities of metadata and communications content. SIM swapping, SS7 exploitation, and attacks against 5G infrastructure are sector-specific concerns. defend.network monitors threats to telecommunications infrastructure and providers.

Microsoft, Fortra vulnerabilities patched; Warlock escalates SharePoint attacks on critical infrastructure

Microsoft shipped nearly 1,000 patches; Fortra issued critical BoKS updates; Warlock ransomware escalates SharePoint exploits against water utilities, telecom operators, and government bodies in Portuguese/Spanish-speaking regions.

Critical RCEs in GitLab, Dell CSM, SharePoint; Warlock ransomware escalates

GitLab patches critical AI Gateway RCE; Dell CSM flaws grant unauthenticated root access on Kubernetes; Warlock ransomware expands SharePoint exploitation across critical infrastructure in multiple countries.

Hardware attack breaks Intel/AMD confidential computing; Gitea RCE exploited across six countries

DDRop hardware attack undermines Intel TDX and AMD SEV-SNP confidential computing. Japan's Digital Agency confirms VPN breach of 246K personnel records. Red Heron exploits Gitea RCE to compromise 13 organizations across six countries.

MikroTik routers, Magento zero-day, and Chromium V8 actively exploited

MikroTik routers hijacked without authentication; Magento/Adobe Commerce zero-day in active exploitation; REVSTEALER disables Defender to mine crypto; Chromium V8 in CISA KEV.

Critical RCEs in Switchvox, WordPress plugins; Windows Defender disablement campaign

malware campaign disables Windows Defender. Four AI coding agent vulnerabilities remain unpatched.

Russian intel evolves Signal phishing; Cisco actively exploited; KDDI breach hits 14.2M

Russian intelligence phishing campaign now targets Signal backup recovery keys; Cisco vulnerability under active exploitation with CISA emergency deadline; KDDI email breach exposes 14.2M credentials across six ISPs.

Critical RCEs: Microsoft Defender, Linux kernel, Cisco Workload; Showboat targets telcos

Microsoft Defender vulnerabilities actively exploited; 9-year-old Linux kernel flaw enables root execution; Cisco Workload max-severity RCE patched; Showboat malware targets telcos across Middle East and Central Asia.

Chinese APT in telecom backbone; Langflow zero-day exploited

State-sponsored Chinese APT embedded in telecom backbone, critical Langflow AI vulnerability actively exploited, wiper malware targeting Iran systems, and zero-click AI assistant vulnerabilities require immediate response.

Vulnerability Report – Week 4 of September 2026

This week's threat landscape is dominated by active exploitation of Microsoft SharePoint vulnerabilities by the China-linked Warlock ransomware group targeting critical infrastructure, government, and

Vulnerability Report – Week 1 of June 2026

Three verified CVEs dominated this week's reporting: one actively exploited Linux kernel vulnerability (CVE-2022-0492) now in CISA's Known Exploited Vulnerabilities catalog, one proof-of-concept relea

Vulnerability Report – Week 3 of May 2026

This week presents an exceptionally high-risk threat landscape with multiple critical vulnerabilities under active exploitation across infrastructure, enterprise, and open-source ecosystems. Immediate

Vulnerability Report – Week 1 of May 2026

This week presents an exceptionally high-risk threat landscape dominated by active exploitation campaigns and critical infrastructure vulnerabilities. Federal agencies face an immediate Sunday deadlin

Vulnerability Report – Week 4 of April 2026

This week presents elevated risk from actively exploited vulnerabilities across network infrastructure, IoT devices, and enterprise software. Immediate patching is required for Cisco Firepower/ASA dev

Vulnerability Report – Week 3 of April 2026

This week presents elevated risk across OT/ICS sectors with multiple critical RCE vulnerabilities in industrial control systems and emerging threats to cloud infrastructure. Active exploitation of Mic

Vulnerability Report – Week 2 of April 2026

This week presents an elevated threat landscape dominated by actively exploited critical vulnerabilities in both IT and OT environments. Iranian-affiliated threat actors are actively targeting US crit

Vulnerability Report – Week 1 of April 2026

This week presents elevated risk with five critical vulnerabilities actively exploited in the wild, including FortiClient EMS and video conferencing systems requiring immediate patching. Organizations

Vulnerability Report – Week 5 of March 2026

This week reflects sustained critical threats across OT/ICS and enterprise systems with multiple actively exploited vulnerabilities. F5 BIG-IP APM (CVE-2025-53521) and Citrix NetScaler (CVE-2026-3055)

Vulnerability Report – Week 3 of March 2026

This week demands immediate attention. Two actively exploited vulnerabilities (VMware ESXi and FortiOS) require emergency patching. Organizations using Windows Server should prioritize the kernel priv