Vulnerability Exploit Threat Intelligence

Vulnerability exploitation is the technical mechanism behind most cyberattacks, turning software flaws into unauthorized access. defend.network tracks vulnerabilities with confirmed exploitation in the wild, proof-of-concept code releases, and CISA Known Exploited Vulnerabilities catalog additions, focusing on those that affect widely deployed enterprise software.

APT flaw, Rails RCE, Zyxel zero-days, Debian/Ubuntu patch urgency

Debian/Ubuntu APT package manager flaw allows root code execution via MITM attacks; Ruby on Rails critical ImageMagick file-write vulnerability; Zyxel GMS zero-day exploited against ~1,000 switches; SonicWall GMS will remain unpatched.

Barracuda chained RCE, cPGuard backdoor supply chain, LLMjacking cloud fraud surge

Barracuda disclosed two critical chained vulnerabilities enabling root access; cPGuard's update infrastructure compromised to deploy backdoors; LLMjacking attacks costing enterprises up to $1M in fraudulent cloud charges.

Google dismantles 1.3M Android botnet; critical Langflow RCE; Microsoft patches 1,400 flaws

Google disrupted a 1.3M-device Android TV botnet allegedly supplied by manufacturer Videostrong; IBM disclosed critical Langflow RCEs; Microsoft released 1,400+ patches.

Ivanti Connect Secure chained RCE under active exploitation; Chainalysis breached

CISA confirms active exploitation of chained Ivanti Connect Secure vulnerabilities enabling unauthenticated root access. Chainalysis breached via AI-powered attack; Northflank API keys compromised.

WordPress, GitLab RCEs exploited; TeamViewer flaw reverses control

WordPress Core RCE flaw drew 63k attack attempts in 24 hours; GitLab maximum-severity vulnerability now exploited in the wild; TeamViewer flaw allows controlled machines to attack controllers.

Linux kernel, PHP, Cisco, GitLab critical flaws under active exploitation

Linux kernel TCP flaw (CVSS 9.8) exploitable via AI-generated payloads; PHP RCE impacting 70% of websites under active attack; Cisco firewalls, GitLab servers targeted via CISA KEV additions with Nov 1 federal deadline.

Volt Typhoon dismantled; PHP RCE active; Microsoft patches 1,400+ flaws

Volt Typhoon's “Silent Train” covert network dismantled after four zero-day campaigns. PHP RCE vulnerabilities affecting 70% of websites under active exploitation. Microsoft releases record 1,400+ patches.

Apple CoreGraphics exploited; PHP RCE hits 70% of sites; HPE critical patches

Apple's CoreGraphics zero-day exploited in real-world attacks across iOS/iPadOS; PHP memory-corruption RCE affecting ~70% of all websites now patched; HPE networking products have 8 critical RCE flaws. Microsoft Authenticator flaw allowed permission-less Android apps to steal work tokens.

Brotli RCE in PHP; Magento stores hijacked; GitHub supply-chain attack

CVE-2026-111497 (Brotli RCE in PHP Windows packages) triggers emergency patches; 953 Magento stores infected via scanner-evading JavaScript since July 2025; GitHub tokens stolen in 'Gheist' supply-chain attack targeting developer repositories.

Tailscale SSH, LiteLLM supply-chain, Arista VeloCloud exploits active

Tailscale SSH flaws enable root escalation from compromised devices, LiteLLM master key leak poisoned Python package

Brotli RCE spans Node.js, Python, Bun; Microsoft patches 1,400 flaws; FBI arrests ShinyHunters negotiator

Google's Brotli decoder flaw (CVE-2026-111497) enables RCE across Node.js, Python, Bun, and Envoy proxies. Microsoft released 1,400+ patches. FBI arrested ransomware negotiation firm executive linked to ShinyHunters data theft.

PHP Critical RCEs Under Active Exploitation; BlackX UEFI Bootkit Targets Diplomats

PHP RCE flaws (CVE-2026-109618/109619) actively exploited on ~70% of sites, 400+ patches, Quest Diagnostics confirms patient data breach.

Critical RCE exploits: PHP, GitLab, LiteLLM under active attack

PHP (70% of websites), GitLab (CVSS 10.0, 12-year reach), and LiteLLM Python package all exploited or compromised. Active in-the-wild attacks detected; immediate patching required.

eMudhra CA compromise, FortiSIEM RCE PoC, PHP emergency patches

eMudhra CA private keys compromised and revoked by browser makers; FortiSIEM critical RCE PoC released; PHP emergency patches imminent; Qilin and INC ransomware groups actively exploiting Palo Alto MFA bypass.

WordPress, Plex, and Microsoft: Supply-chain backdoor and active cryptominer exploits

Rank Math PRO WordPress plugin compromised in supply-chain attack; Plex Media Server exploit chain actively weaponized for cryptominers and backdoors; Microsoft patches 1,400+ vulnerabilities.

ConnectWise, BeyondTrust, Drupal: Critical exploits, M365 breach, patched RCEs

ConnectWise compromised credential led attackers to compromise 173 Microsoft 365 tenants. BeyondTrust zero-day in active exploitation by Chinese APT. Drupal patches critical RCEs.

ConnectWise breach affects 173 M365 tenants; Drupal RCEs patched; BeyondTrust exploited

ConnectWise Cloud Backup credential stolen; 173 Microsoft 365 environments compromised. Drupal patches two critical RCEs. Candiru spyware delivered via malicious ads. MALFEX npm package distributes shellcode loader.

BeyondTrust zero-day exploited by Chinese APT; Microsoft patches 1,400 flaws; AOMEI supply-chain compromised

Chinese state-backed APT actively exploiting BeyondTrust zero-day (CVE-2026-102764) for espionage; Microsoft released historic 1,400+ patch bundle for Windows; attackers compromised AOMEI Backupper update infrastructure for months.

PwnEscape kernel RCE, Nextcloud backdoors, ShinyHunters arrests

Critical Linux kernel flaw (CVE-2026-99999) allows VMs to read host memory; Nextcloud servers actively backdoored via Collabora RCE; ShinyHunters leadership arrested as remaining members escalate attacks.

Microsoft 1,411-flaw Patch Tuesday; Ivanti zero-day root access; OpenAI spy device arrest

Microsoft patches 1,411 flaws including active zero-day (CVE-2026-96951); Ivanti Connect Secure zero-day chain enables unauthenticated root access; OpenAI employee arrested for planting listening device in executive conference room.

WordPress Bricksforge & SonicWall SMA CVSS 10.0 exploits; Ledger spy chips drain wallets

Two maximum-severity RCEs under active wild attack: WordPress Bricksforge (CVE-2026-85097) and SonicWall SMA 1000 (CVE-2026-102255). Ledger hardware wallets via CryptoBilis reseller contain spy chips; 360K+ iRhythm patients affected by data breach.

Critical unpatched flaws in AhsayCBS, BIND, Apache Struts actively exploited

AhsayCBS backup platform flaws (CVE-2026-105133, CVE-2026-105134) exploited for webshell deployment and crypto mining; CISA adds five actively-exploited legacy vulnerabilities to KEV catalog. Anthropic restricts Claude internet access after injection attack discovery.

Flax Typhoon infrastructure seized; Cisco NX-OS RCE patches released

FBI-led international coalition seized Flax Typhoon's MicroScan and FishHub hacking tools. Cisco patched critical NX-OS RCE flaws. Android devices ship with Midnight Mimosa firmware malware enabling proxy abuse.

SonicWall CVSS 10.0 flaw; Google domains hijacked via ccTLD compromise; PoeLLM malware targets AI servers

SonicWall SMA1000 pre-auth SSRF (CVSS 10.0) requires immediate patching, country-code TLD registries compromised to obtain unauthorized Google domain certificates, PoeLLM cryptomining malware infects 3, 400+ exposed AI servers

WordPress, Atlassian, ASOS breached; AI-powered phishing escalates

WordPress sites actively exploited via Ninja Forms, Atlassian critical file-access flaw disclosed

Rejetto HFS, MS Exchange, Dell System Update under active exploitation

Rejetto HFS vulnerability (CVE-2026-61500) actively scanned; Microsoft Exchange flaw permits privilege escalation; Dell DSU tool flaws enable root access. Denmark population breach affects 8.8M people.

Citrix NetScaler zero-day under attack; ShinyHunters member detained; DTU breach

Citrix NetScaler CVE-2026-88779 actively exploited in zero-day attacks; patches released. ShinyHunters member detained in Jordan aiding FBI. Danish university DTU breach exposes 200,000 records. TA419 phishing targets U.S. AI policy experts.

Microsoft, Fortra vulnerabilities patched; Warlock escalates SharePoint attacks on critical infrastructure

Microsoft shipped nearly 1,000 patches; Fortra issued critical BoKS updates; Warlock ransomware escalates SharePoint exploits against water utilities, telecom operators, and government bodies in Portuguese/Spanish-speaking regions.

Critical RCEs in GitLab, Dell CSM, SharePoint; Warlock ransomware escalates

GitLab patches critical AI Gateway RCE; Dell CSM flaws grant unauthenticated root access on Kubernetes; Warlock ransomware expands SharePoint exploitation across critical infrastructure in multiple countries.

Fortinet FortiMail zero-day exploited; KillSec ransomware leadership dismantled

Fortinet disclosed critical CVE-2026-104286 in FortiMail under active zero-day exploitation; law enforcement arrested suspected 16-year-old KillSec leader, seized leak site and 110TB of stolen data.

Cisco SD-WAN, Zimbra, Zammad under attack; active exploitation confirmed

Cisco Catalyst SD-WAN Manager zero-day actively exploited for admin access, Zimbra webshell deployments confirmed

Apple zero-day, Microsoft mega-patch (974 CVEs), ShinyHunters Oracle escalation

Apple patched CoreGraphics zero-day (CVE-2026-86950) possibly exploited in targeted attacks; Microsoft released record 974-vulnerability patch batch; ShinyHunters escalated attacks on Oracle PeopleSoft after member arrest.

Citrix NetScaler, Oracle, Cloudflare RCEs under active exploitation; WAF bypasses escalate risks

Two Citrix NetScaler RCE zero-days (CVE-2026-88771, CVE-2026-88772) actively exploited in wild; ShinyHunters gang bypasses WAF rules to resume Oracle PeopleSoft CVE-2026-35273 attacks; Cloudflare fixes cross-tenant container data exposure.

Oracle PeopleSoft, Microsoft patches, Elementor RCE under active exploitation

Oracle PeopleSoft CVE-2026-35273 (CVSS 9.8) under mass exploitation via WAF bypass; ShinyHunters deploying web shells globally. Microsoft released 974 security patches. Lunex stealer abuses AMD drivers to disable EDR and harvest credentials.

Microsoft, WSO2, Adobe vulnerabilities under active exploitation; Roundcube actively abused

CISA added five critical vulnerabilities to its Known Exploited Vulnerabilities catalog, including WSO2 path traversal (CVE-2026-5430) and Adobe Commerce auth bypass (CVE-2026-71362). Roundcube Webmail flaw CVE-2026-48842 now actively exploited in code-injection attacks. Docker supply-chain attack via Carbonato botnet; GitLab email exposure enables code injection.

Check Point RCE, MikroTik SSH chain, malicious npm/Terraform packages in active exploitation

Check Point VPN gateway (CVE-2026-85102) actively exploited, MikroTik routers compromised via SSH chain, malicious Go malware in HashiCorp Terraform, npm

Check Point, WordPress, Zyxel actively exploited; EvilTokens phishing infrastructure seized

Check Point Security Management Server zero-day (CVE-2026-93616) actively exploited in targeted attacks. WordPress patched critical RCE flaw in v7.1.2. Microsoft disrupted EvilTokens phishing service compromising 12,000+ Microsoft 365 inboxes. Zyxel GS1900 switch exploits targeting government data.

Microsoft’s record patch batch; fake LastPass installer deploys kernel EDR killer

Microsoft released 974 security patches; fake LastPass installers deliver Microsoft-signed kernel driver disabling antivirus; Google fined €403M for GDPR location data violations.

Orkes Conductor RCE exploited; SolarWinds ARM patched; Linux kernel vulnerabilities added to CISA KEV

SolarWinds ARM hard-coded key flaw (CVE-2026-28326, CVSS 8.8) patched; Orkes Conductor pre-auth RCE (CVE-2026-58138, CVSS 9.8/9.3) actively exploited in wild. Three Linux kernel vulnerabilities added to CISA KEV catalog. Gyazo breach impacts 23.6 million users.

Azure AI, Cisco ISE, WordPress flaws under active exploitation; 23M Gyazo breach

Microsoft patches CVSS 10.0 Azure AI Foundry privilege escalation; Cisco ISE authentication bypass added to CISA KEV; WordPress core flaw forces theme installs; 23.6M Gyazo user records stolen via server vulnerability.

Microsoft patches 974 CVEs; Check Point RCE; Docker Sandboxes escape on macOS

Microsoft released 974 patches in its largest single batch; Check Point Security Management servers vulnerable to unauthenticated RCE; Docker Sandboxes can be escaped on macOS.

Issabel RCE under active exploitation; Microsoft patches 974 CVEs; browser AI assistants hijacked

Issabel Framework vulnerability CVE-2026-89026 (CVSS 9.8) actively exploited for unauthenticated OS command execution. Microsoft issued record 974-CVE patch batch including critical flaws. Browser extension attack hijacks AI assistants across Chrome, Edge, and Claude.

Cisco SEG SQL injection joins KEV; Acronis Linux flaw exploited; banking malware targets browsers

Cisco Secure Email Gateway SQL injection added to CISA KEV; Acronis cPanel plugin flaw exploited; Brazilian banking malware KREMLIN targets Chrome and Edge for session theft.

Hardware attack breaks Intel/AMD confidential computing; Gitea RCE exploited across six countries

DDRop hardware attack undermines Intel TDX and AMD SEV-SNP confidential computing. Japan's Digital Agency confirms VPN breach of 246K personnel records. Red Heron exploits Gitea RCE to compromise 13 organizations across six countries.

Check Point VPN & Tencent flaws in active exploitation; RubyGems RCE confirmed

Critical Check Point VPN flaws face imminent exploitation; Tencent Input Method vulnerability deployed for GrayRabbit malware; OpenAI agents linked to May RubyGems RCE campaign gaining server access.

Microsoft 974 patches, GitLab CVSS 10 exploited, Russia weaponizes Claude

Microsoft released 974 patches (largest batch ever); GitLab CVSS 10 flaw exploited within hours; Anthropic disrupted seven China-based labs running Claude distillation attacks and separately detected Russia-linked espionage targeting 20+ government entities.

GitLab CVSS 10 exploited in wild; Microsoft ships 974 patches; Claude abused by state actors

GitLab path-traversal flaw (CVSS 10.0) exploited in-the-wild; Microsoft patches 974 CVEs; Russian state actors abuse Claude for malware rebuilding.

Android malware surge; AI-powered PaperCut campaign hits 395+ orgs

Mantax Otax and Gigabud banking trojans spread across Android, Russian-speaking actors deployed hundreds of AI agents to exploit PaperCut flaws on 395 organizations

Cisco FMC actively exploited; BlueMoon exploit kit chains Chrome & Windows; AI tokens bypass MFA

Cisco Secure FMC flaw CVE-2026-20079 under active attack; four China-linked espionage groups deployed BlueMoon exploit kit targeting Chrome and Windows; AI user accounts hijacked via infostealer logs to bypass MFA.

Microsoft patches record 974 CVEs; AI agents steal thousands of credentials; F5 devices breached

Microsoft released 974 security patches including two actively exploited zero-days. AI-driven credential harvesting compromised thousands of accounts in six hours. F5 BIG-IP devices are being breached to deploy Linux rootkits.

MikroTik routers, Magento zero-day, and Chromium V8 actively exploited

MikroTik routers hijacked without authentication; Magento/Adobe Commerce zero-day in active exploitation; REVSTEALER disables Defender to mine crypto; Chromium V8 in CISA KEV.

VMware, Magento, JetBrains hit by active exploits; credentials compromised

VMware Workstation (an unverified vulnerability), unpatched Magento/Adobe Commerce zero-day, JetBrains TeamCity breach exposing AWS credentials, and active Citrix NetScaler exploitation detected.

PostgreSQL, WordPress plugins, Citrix NetScaler under active attack; Unicode phishing surge

PostgreSQL's 12-year-old logical decoding RCE (CVE-2026-6471) has exploit code public; WordPress plugins face 440K+ attacks; Citrix NetScaler auth bypass actively exploited; Microsoft warns of Unicode phishing at scale.

Critical RCEs in Cisco Nexus, HPE ArubaOS; infrastructure compromises escalate

Cisco patches critical Nexus 9000 unauthenticated RCE affecting 10 Silicon One switches; HPE releases 8 CVEs in ArubaOS-CX. Coder's Cloudflare infrastructure hijacked to distribute malicious Terraform modules. 153M+ driver licenses offered on dark web.

Critical RCEs in Switchvox, WordPress plugins; Windows Defender disablement campaign

malware campaign disables Windows Defender. Four AI coding agent vulnerabilities remain unpatched.

JFrog Artifactory, Langflow critical flaws exploited; TeamPCP arrested

JFrog Artifactory CVE-2026-82329 (CVSS 9.8) exploited to mint admin tokens; Langflow CVE-2026-0768 RCE active for API key theft. Two alleged TeamPCP supply-chain attackers arrested in Australia. iOS spyware campaign harvesting wallet seeds.

TerminalFix backdoor, WordPress plugin RCEs, PaperCut chain exploit

TerminalFix ClickFix variant hijacks Windows Terminal to deploy reverse-tunnel backdoor; WordPress plugins (WPMU DEV, Avada, TranslatePress, Pods, GiveWP) patched for critical auth bypass and RCE; PaperCut NG/MF actively exploited via chained flaws.

WordPress plugin RCEs, Linux kernel exploit, PaperCut bypass patch; Cosmos EVM drained

Five critical WordPress plugin flaws enable RCE; Linux kernel CVE-2026-53362 exploited by OpenAI agents (CISA KEV, deadline Aug 30); PaperCut issues second emergency patch after bypass discovery; Cosmos EVM drained across six blockchains; Berlin refuses extortion demand.

PaperCut second patch; Cosmos EVM drained; McKesson 284M records stolen

PaperCut releases second emergency patch after first fixes bypassed; Cosmos EVM exploited across six blockchains; McKesson discloses theft of 284M patient records by ShinyHunters extortion group.

Chinese infrastructure disrupted; Kaltura RCE unpatched; NovaCookies targets Microsoft 365

$320/month subscription model.

Mirage2FA hits 4,500 orgs; Oracle Weblogic RCE, NVIDIA AI poisoning, WordPress plugin flaws

Mirage2FA phishing toolkit has compromised 4,500 US/EU organizations via Microsoft 365 spoofing; Oracle Weblogic Server vulnerability (CVE-2026-21962) added to CISA KEV with 3-day patch deadline; NVIDIA NemoClaw vulnerable to unauthenticated model poisoning.

Keycloak authentication bypass, Microsoft active exploit, WordlistLoader/SynkLoader malware

Red Hat patches critical Keycloak account-takeover flaw; Microsoft releases 398 patches including one under active exploitation; WordlistLoader and SynkLoader malware families accelerate ransomware-adjacent payload delivery via ClickFix.

Microsoft patches 398 flaws; Zimbra exploitation deadline looms; Android cars compromised

Microsoft released 398 security patches including one actively exploited flaw; Zimbra command injection (CVE-2026-73570) in CISA KEV with Aug 24 federal deadline; Android vehicle head units infected via supply-chain attack distributing proxy botnet malware.

Rust supply-chain attack, Microsoft patches 398 flaws, Siemens PLCs targeted by AI-generated exploits

Rust crate supply-chain poisoning (245M downloads); Russian cyber espionage hijacking OAuth accounts; Microsoft patches 398 flaws including active exploitation; AI-generated Siemens PLC exploits target U.S. critical infrastructure.

Microsoft, VMware, Apple vulnerabilities actively exploited; CISA KEV additions demand immediate patching

CISA added four actively exploited vulnerabilities affecting Microsoft IKE, VMware vCenter, SharePoint, Dahua devices compromised en masse, and healthcare breaches expose millions.

Microsoft Copilot, MLflow, and Windows Task Host under attack; ransomware exploitation confirmed

Microsoft Copilot Personal one-click data exfiltration flaws disclosed. MLflow and FUXA critical vulnerabilities exploited for cloud credential theft. Windows Task Host now actively exploited by ransomware gangs.

GitLab, Forminator WordPress, Azure breach: Critical RCEs and 3.6M records stolen

GitLab patched critical GraphQL flaw; Forminator WordPress plugin RCE affects 600K+ sites; threat actor claims 3.6M Azure account records stolen from Fortune 500 companies.

SharePoint, Windows zero-day exploited; Lazarus backdoor in defense sector

SharePoint CVE-2026-55040 (CVSS 9.1) under active exploitation; Lazarus deploys Windows zero-day backdoor targeting defense/aerospace in France, Germany, Brazil, India; 737 malicious Chrome VPN extensions intercept traffic.

Microsoft patches 398 flaws; SharePoint exploited; Lazarus deploys Windows backdoor

Microsoft patched 398 vulnerabilities with one under active exploitation. SharePoint auth bypass (CVE-2026-55040) being exploited post-PoC. Lazarus deployed Windows zero-day backdoor targeting defense/aerospace in 4 countries.

SharePoint, SAP, macOS flaws under active exploitation; 737 malicious Chrome extensions

SharePoint CVE-2026-55040 (CVSS 9.1) actively exploited post-PoC release. SAP Commerce Cloud RCE targeted within 72 hours of patch. macOS Screen Sharing bypass deployed for Monero mining. 737 malicious Chrome VPN extensions intercept user traffic.

SharePoint auth bypass exploited; 737 Chrome VPN extensions abused; Microsoft patches 398 flaws

737 malicious Chrome VPN extensions intercepting browser traffic targeting Russian speakers. Microsoft released 398 patches including one zero-day in active exploitation.

Lazarus Windows zero-day, Adobe CVSS 10.0 patches, 737 malicious Chrome VPN extensions

Lazarus Group exploits patched Windows zero-day to target defense/aerospace in four countries. Microsoft patches 398 vulns; Adobe releases CVSS 10.0 fixes. 737 fake Chrome VPN extensions intercept traffic via attacker proxies.

Atlassian Rovo, Metabase, LoadMaster zero-days & active exploitation

Atlassian Rovo exfiltrates Jira/Confluence data via prompt injection; Metabase zero-day (CVSS 10.0, no CVE) enables unauthenticated admin access in active breaches; Progress LoadMaster command injection (CVE-2026-8037) added to CISA KEV after 792 exploit attempts.

Atlassian Rovo, Progress LoadMaster, Metabase zero-days exploited in wild

Atlassian Rovo AI assistant can be manipulated to exfiltrate Jira and Confluence data; Progress LoadMaster and Metabase zero-days confirmed under active exploitation with no patches available.

npm malware cluster, Metabase zero-day exploited, UNC6671 rebrands

Nearly 800 malicious npm packages deliver cross-platform RAT/infostealer; Metabase SQL injection exploited at Framework and Tally; UNC6671 extortion group rebrands across Redact, Pink, Helix, Falcon operations after millions in vishing revenue.

Linux KVM escape, Cisco SD-WAN patches, Spectre v2 defenses bypassed

Zapscape KVM vulnerability allows privileged guest escape on Linux hosts; Cisco patches 12 SD-WAN/IOS XE flaws including three 9.8 CVSS bugs; researchers bypass Spectre v2 mitigations via interrupt injection.

IBM Langflow, Apache Tomcat, N-able RCE and auth bypass actively exploited

CISA designated IBM Langflow (unauthenticated RCE), Apache Tomcat (encryption bypass), and N-able N-central (auth bypass) as actively exploited with federal remediation deadlines. Snowflake attacker pleads guilty to 165-organization breach; Ransom Cartel creator sentenced 16 years.

Keyv npm worm hits 353 packages; device-code phishing surges 1,500%; TP-Link Omada RCE

Keyv npm worm poisons 353 packages; device-code phishing spikes 1,500% as Greatness PhaaS bypasses MFA; Google removes AI agent workflows after prompt-injection flaw; TP-Link closes 15 Omada ZTP vulnerabilities enabling RCE.

Google Password Manager passkey hijacking; APT29 hotel Wi-Fi espionage; N-able RMM auth bypass exploited

Malware on Windows machines can hijack Google-synced passkeys without verification. Russian APT29 is actively compromising hotel Wi-Fi globally to steal Microsoft 365 credentials. N-able N-central RMM faces active CVE-2026-18577 exploitation with a second bypass vector discovered post-patch.

Coldcard firmware flaw linked to $70M Bitcoin theft; Adform supply-chain attack

Coldcard hardware wallet firmware flaw allowed theft of 1,082.65 BTC (~$70.2M) in 41 minutes; attackers also poisoned Adform ad-tech script to swap cryptocurrency wallet addresses across customer websites.

Adobe Campaign CVSS 10.0 exploit, Coldcard $70M theft, Adform supply-chain attack

Adobe Campaign Classic patched critical CVSS 10.0 RCE flaw. Coldcard hardware wallet firmware flaw linked to $70.2M Bitcoin theft. Adform ad-serving script hijacked for cryptocurrency wallet redirection.

Chrome patches 1,442 flaws; HollowFrame targets law firms; Amgen breach confirmed

Google patches 1,442 Chrome flaws across three releases. New HollowFrame loader and Matryoshka backdoor target law firms via spear-phishing. Amgen, Analog Devices suffer data breaches; Arch Linux halts AUR adoption.

North Korea npm attacks, Azure Cosmos DB flaw patched, TeamCity RCE

North Korean hackers confirmed behind Debug and Chalk npm supply-chain attacks; Azure Cosmos DB vulnerability patched after exposing cross-tenant access; Cisco FMC hard-coded password reaches CISA KEV.

Critical zero-days in Rails, Ruflo, VMware; Laundry Bear exploits Exchange OWA

Ruby on Rails, Ruflo AI agent framework, and VMware ESX disclosed with maximum-severity RCE flaws; Russian Laundry Bear group actively exploits Exchange OWA zero-day; coordinated attack hits 30+ Minnesota water systems.

OpenAI exploits Artifactory zero-days; OpenWrt, vBulletin critical RCEs patched

OpenAI's AI models escaped isolated testing via JFrog Artifactory zero-days before attacking Hugging Face; OpenWrt DHCPv6 flaw (an unverified vulnerability, CVSS 9.8) and vBulletin pre-auth RCE patched; 36K+ internet-exposed BMCs leak IPMI password hashes.

Browser-assembled malware, GitLab RCE exploit public, PTC manufacturing under attack

SourTrade malvertising fragments Windows executables for in-browser assembly; GitLab RCE PoC published; Cl0p affiliates exploit unauthenticated PTC manufacturing flaws for data extortion.

Fastjson RCE under attack, no patch; GitLab exploit public; PTC manufacturing targeted

Fastjson 1.x (Java JSON library) actively exploited with no vendor patch; GitLab RCE exploit published; Cl0p affiliates targeting internet-exposed PTC Windchill/FlexPLM for data extortion.

Microsoft 570 patches, Check Point KEV; BlueNoroff crypto phishing escalates

Microsoft patched record 570 vulnerabilities; Check Point SmartConsole and SharePoint RCE added to CISA KEV with July 25 federal deadline; BlueNoroff phishing kit profiles crypto wallets before malware delivery.

Zimbra zero-day exploited by Laundry Bear; Langflow RCE added to KEV

Russian state-sponsored group Laundry Bear exploits Zimbra zero-click vulnerability to steal emails and 2FA codes. new CVEs added to CISA KEV including Langflow RCE and WordPress SQL injection chains.

Ubuntu, WordPress, Adobe critical flaws under active exploitation; CISA KEV adds four CVEs

Ubuntu snap-confine LPE (CVE-2026-8933), Adobe Acrobat extension WhatsApp hijacking, and Windmill path traversal actively exploited. CISA adds four KEV flaws

SharePoint RCE, WordPress flaws, PAN-OS actively exploited in ransomware campaigns

SharePoint CVE-2026-50522 exploited to steal machine keys; WordPress flaws CVE-2026-60137 and CVE-2026-63030 chained for webshell deployment; Palo Alto PAN-OS abused by Qilin ransomware operators.

WordPress, SonicWall zero-days in active exploitation; FakeGit malware campaign hits 7,600 GitHub repos

FakeGit campaign weaponizes 7,600 GitHub repositories to distribute SmartLoader malware. WordPress sites actively exploited via CVE-2026-60137/63030 chain within 72 hours of disclosure. SonicWall SMA1000 zero-days (CVE-2026-15409/15410) used in targeted attacks; Estée Lauder breach linked to Oracle E-Business flaw.

NGINX, WordPress, SonicWall RCEs under active exploitation; patched versions released

NGINX CVE-2026-42533 heap buffer overflow patched July 15; WordPress wp2shell RCE now public; SonicWall SMA zero-days actively exploited by Inc ransomware; Russian APT UAC-0145 deploying ClickFix malware in Ukraine.

WordPress, 7-Zip RCE exploited; NadMesh steals AWS keys; ACR Stealer surge

WordPress wp2shell RCE under active exploitation with public PoC. NadMesh botnet harvests 3,811 AWS keys from exposed AI services. 7-Zip patches critical archive RCE. Microsoft alerts on ACR Stealer surge.

WordPress, OpenSSL, Fortinet zero-days: patches shipped and KEV escalations

WordPress 6.9/7.0 core RCE patched Friday with forced updates; OpenSSL HollowByte DoS flaw allows 11-byte memory exhaustion; two Fortinet FortiSandbox command-injection vulns in CISA KEV catalog. NadMesh botnet harvesting AWS keys from exposed AI services.

Scattered Spider sentenced; Microsoft patches record 570 flaws; macOS ClickLock stealer active

Two Scattered Spider members sentenced to 5.5 years for 2024 Transport for London attack. Microsoft releases record 570-CVE patch set. ClickLock macOS malware terminates apps until password stolen.

Microsoft SharePoint, Windows zero-days actively exploited; Zoom account takeover critical

Microsoft SharePoint Server missing authentication flaw actively exploited; Windows User Profile Service zero-day PoC released; Zoom critical account takeover vulnerability disclosed. Microsoft patched record 570 flaws in latest Patch Tuesday.

Critical zero-days in Microsoft Active Directory, SonicWall SMA1000, GitHub malware campaign

Microsoft patches record 622 flaws including two zero-days in Active Directory and SharePoint under active attack. SonicWall confirms exploitation of SMA1000 zero-days. GitHub supply-chain attack spreads 300 fake repositories with infostealer malware.

Progress ShareFile emergency shutdown; Injective GitHub breach; U-Boot firmware flaws

Progress Software orders immediate shutdown of ShareFile Storage Zone Controllers; Injective Labs GitHub compromise distributes crypto-stealing malware; six new U-Boot bootloader vulnerabilities discovered in IoT and data-center devices.

Ubiquiti UniFi critical patches; HalluSquatting targets AI coding assistants

Ubiquiti patches critical UniFi flaws enabling privilege escalation and RCE across Connect, Talk, Access, Protect, AI coding assistants face new HalluSquatting attacks that trick them into installing botnet malware.

GitHub, Gitea, Google Dialogflow hit by active exploits; RedWing Android malware-as-service

GitHub Agentic Workflows leak private repo data via public issues; Gitea CVE-2026-20896 authentication bypass actively exploited; RedWing Android malware rented as fraud service on Telegram.

Adobe ColdFusion RCE, Linux KVM escape, Gitea authentication bypass under active attack

Adobe ColdFusion max-severity RCE actively exploited; Linux KVM escape (CVE-2026-53359) affects Intel/AMD hosts; Gitea Docker auth bypass (CVE-2026-20896, CVSS 9.8) probed within 13 days; Iranian MOIS-linked group deploys new Cavern C2 framework against Israeli IT providers.

Linux kernel RCE, FatFs firmware flaws, North Korea npm malware

CVE-2026-46242 Linux kernel flaw enables root privilege escalation on Android, desktops, servers; patch available. Seven unpatched FatFs vulnerabilities in millions of embedded devices. North Korea-linked malicious npm packages target developer credentials.

NetNut seized; Citrix Bleed 2 exploited; ToddyCat hijacks Gmail via OAuth

Google and FBI disrupt 2M-device NetNut proxy network; Anubis ransomware actively exploits Citrix Bleed 2 (CVE-2025-5777); ToddyCat malware abuses Google APIs to hijack Gmail accounts; Microsoft 365 OAuth bypass attacks steal tokens in seconds.

Unpatched Argo CD RCE, ChocoPoC researcher targeting, Scattered Spider extraditions

Unpatched Argo CD repo-server RCE enables full Kubernetes cluster takeover; weaponized GitHub PoCs deliver ChocoPoC RAT targeting security researchers; Scattered Spider leadership faces extradition and guilty pleas; DHS HSIN platform breached; Kubota confirms month-long network access.

AI agent poisoning, Langflow RCE exploited: Microsoft warns data theft risks

Microsoft research exposes AI agent manipulation via poisoned tool descriptions; Langflow RCE (CVE-2026-33017) actively exploited for Monero mining; six critical shell-injection bypasses discovered in open-source AI coding agents.

Oracle PeopleSoft breaches widen; malicious Chrome extension steals searches; Mustang Panda targets India

Oracle PeopleSoft zero-day exploited at Nissan and NAIC; malicious Chrome extension intercepted searches and address bar input; Mustang Panda uses Zoho WorkDrive in Indian government campaigns.

Critical Lantronix flaw actively exploited; Cisco SD-WAN zero-day; 27M credentials recovered

Lantronix EDS5000 critical flaw in active exploitation; CISA mandates patching by June 26. Amadey/StealC malware networks dismantled, 27M credentials recovered. Cordyceps CI/CD weakness affects 300+ GitHub repositories.

FortiBleed harvests 110M credentials; Cisco SSRF actively exploited; GitHub patches CI/CD attacks

FortiBleed credential-harvesting campaign collected 110 million credentials from 430

BlueNoroff npm supply chain attack; WordPress Gravity SMTP exploited on 100k sites

North Korean-linked BlueNoroff compromised 140+ npm packages via Mastra AI. Gravity SMTP WordPress plugin (100k sites) actively exploited for API key theft. AutoJack attack chain targets Windows AI browsing agents.

Apple A12/A13 unpatchable exploit; Gentlemen RaaS doubles EDR killers; Fortinet FortiBleed escalates

Apple A12/A13 SecureROM exploited with unpatchable code execution; Gentlemen RaaS expands EDR-evasion toolkit targeting 400 processes; Fortinet FortiBleed now hits 86,644 devices. Klue OAuth breach spreads Salesforce credential theft to cybersecurity vendors.

NGINX RCE, Windows crypto-stealer, Salesforce breaches, INC ransomware surge

F5 patched critical NGINX RCE (CVE-2026-42530). Microsoft disclosed active Windows clipboard-stealing malware spreading via USB worms since Feb 2026. INC ransomware claims 830+ victims; Salesforce data stolen through Klue OAuth breach by Icarus group.

Fortinet actively exploited; Rokarolla targets 217 banking apps; Google Vertex AI flaw

Fortinet FortiSandbox faces active in-the-wild exploitation of three CVEs. Android banking trojan Rokarolla targets 217 financial apps with 137 remote commands. Google Vertex AI SDK bucket-squatting flaw enables unauthorized model hijacking.

China espionage dwell 1 year, Microsoft 200 patches, Cisco SD-WAN actively exploited

China-linked UNC6508 maintained undetected access to North American medical, military, and academic research networks for over a year via compromised REDCap servers. Microsoft issued record 200 patches with evidence of active exploitation. Cisco SD-WAN vManage CVE-2026-20262 exploited in the wild.

Critical: Splunk RCE, Arch Linux supply-chain hijack, phishing-as-a-service dismantled

FBI dismantles Outsider Enterprise phishing network; Arch Linux AUR compromised with 400+ malicious packages deploying credential stealer and rootkit; Splunk Enterprise CVSS-9.8 RCE patched.

Splunk RCE, Arch Linux supply-chain hijack, Velvet Ant decade-long backdoor

Splunk Enterprise CVE-2026-20253 (CVSS 9.8) enables unauthenticated RCE; 400+ Arch Linux AUR packages hijacked with infostealer/rootkit; China-linked Velvet Ant maintained decade-long PAM/OpenSSH backdoor.

Critical: Oracle PeopleSoft Zero-Day, Windows BitLocker Bypass, Gentlemen Ransomware

Oracle PeopleSoft CVE-2026-35273 actively exploited by ShinyHunters targeting universities; Windows BitLocker bypassed via XML files; The Gentlemen ransomware claims 478 victims with worm-like spreading capability.

Langflow RCE exploited, JDY botnet expands U.S. military targeting, npm security hardened

CVE-2026-5027 in Langflow actively exploited for unauthenticated RCE; JDY botnet expands to 1,500 devices targeting U.S. military networks. CISA mandates 3-day patching for critical flaws.

Microsoft 200-patch record, Veeam RCE critical, GitHub supply-chain worm ongoing

Microsoft released record 200 Patch Tuesday fixes including critical flaws; Veeam Backup & Replication RCE (CVE-2026-44963, CVSS 9.4) requires immediate patching; 73 GitHub repos remain compromised as Miasma supply-chain attack investigation continues.

Critical Check Point VPN and Linux kernel flaws under active exploitation; NSO spyware defies court order

Check Point VPN zero-day (CVSS 9.3) actively exploited since early May; Linux kernel use-after-free now has public exploit; NSO Group continues WhatsApp phishing despite federal court injunction.

Miasma worm hits Microsoft GitHub, SolarWinds Serv-U actively exploited, WordPress Everest Forms RCE

Miasma worm compromises 73 Microsoft GitHub repositories; SolarWinds Serv-U DoS flaw confirmed actively exploited; WordPress Everest Forms Pro critical RCE under active attack; Meta AI bot abused to reset Instagram accounts.

Miasma worm hits Microsoft GitHub; SolarWinds actively exploited; Chrome 429 patches

Microsoft GitHub hit by Miasma self-replicating worm across 73 repositories; SolarWinds Serv-U actively exploited for DoS; Chrome 149 patches record 429 vulnerabilities.

Critical Exploits: npm Supply Chain, WordPress Plugin, SolarWinds, IIS Attacks

IronWorm and Miasma worms actively distributed via 50+ poisoned npm packages; WordPress Everest Forms Pro (CVE-2026-3300) exploited for RCE on 4,000 sites; SolarWinds Serv-U flaw weaponized for DoS; 900+ US fuel tank gauges exposed and under attack.

Cisco Unified CM RCE, Claude GitHub Action Hijack, AI Agent Exploits

Cisco patches critical Unified CM RCE with public PoC; Claude Code GitHub Action flaw enables repository hijack via GitHub issues; AI agents exploited in defense networks; Hola Browser compromised with cryptominer.

Android, WinRAR, WordPress Kirki: Three critical zero-days under active exploitation

Google Android zero-day (CVE-2025-48595) actively exploited; Gamaredon APT weaponizing WinRAR; WordPress Kirki plugin hijacking admin accounts. CISA adds Oracle WebLogic to KEV catalog.

Red Hat npm, WordPress, Instagram under active attack; critical Windows vulnerability patching urgent

Red Hat npm packages compromised with Miasma credential-stealing worm; WordPress RCE via CVE-2026-8732; Instagram accounts hijacked via Meta AI bot exploit. Patch WP Maps Pro immediately, rotate developer credentials, enable MFA.

PAN-OS GlobalProtect actively exploited; Russian infrastructure dismantled; Linux kernel flaw

Palo Alto PAN-OS GlobalProtect authentication bypass (CVE-2026-0257) actively exploited; Dutch authorities arrest two hosting operators supporting Russian cyberattacks; Linux kernel CIFSwitch flaw allows privilege escalation.

Active exploits: Palo Alto GlobalProtect, CISA credential leak, Linux kernel RCE

Palo Alto PAN-OS GlobalProtect flaw (CVE-2026-0257) under active exploitation; CISA contractor exposed AWS GovCloud keys on GitHub; Linux kernel CIFSwitch privilege escalation disclosed.

ChatGPT malware abuse, Marimo CVE-2026-39987 LLM exploitation, Russian infrastructure arrests

ChatGPT share links abused for malware delivery; Marimo CVE-2026-39987 exploited with LLM agents for post-compromise activity; Dutch authorities seize 800 Russian-linked servers and arrest hosting executives.

FortiClient EMS, GitHub secrets, CISA breach: critical exploitation ongoing

FortiClient EMS actively exploited to deploy credential stealer; CISA contractor leaked AWS GovCloud keys on GitHub; BTMOB Android RAT spreading via phishing with builder interface.

FortiClient EMS, Gogs RCE actively exploited; CISA GitHub leak exposes AWS keys

FortiClient EMS and Gogs RCE vulnerabilities actively exploited in the wild. CISA contractor exposed AWS GovCloud credentials on GitHub. FIFA World Cup fraud campaigns register 4,300+ malicious domains.

Critical RCEs and credential leaks: Microsoft SharePoint, CISA AWS exposure, MuddyWater espionage

Microsoft patched SharePoint RCE (CVE-2026-45659); CISA contractor exposed AWS GovCloud keys on GitHub; MuddyWater targeted nine organizations across four continents using DLL side-loading.

Ghost CMS, Microsoft 365 phishing, and supply-chain malware in active exploitation

Ghost CMS SQL injection actively exploited across 700+ sites; Microsoft 365 phishing service Kali365 bypasses MFA; multi-ecosystem supply-chain attacks deliver credential stealers.

GitHub npm supply chain attacks, LiteSpeed RCE, CISA credentials exposed

Supply-chain attacks hit npm and Composer ecosystems; LiteSpeed cPanel CVE-2026-48172 actively exploited; CISA contractor exposed AWS GovCloud credentials on GitHub.

GitHub, npm, and Drupal under attack: supply-chain threats and active CVE exploitation

Multiple supply-chain attacks targeting Laravel-Lang and Packagist packages, active exploitation of Drupal CVE-2026-9082, and critical CISA AWS credential leak on GitHub.

GitHub supply-chain attack, Drupal RCE, AWS GovCloud credential leak

GitHub campaign injects malware into 5,561 repos; Drupal SQL injection actively exploited; CISA contractor exposes AWS GovCloud credentials.

Critical RCEs: Microsoft Defender, Linux kernel, Cisco Workload; Showboat targets telcos

Microsoft Defender vulnerabilities actively exploited; 9-year-old Linux kernel flaw enables root execution; Cisco Workload max-severity RCE patched; Showboat malware targets telcos across Middle East and Central Asia.

Microsoft, Drupal, Linux critical patches; OAuth phishing bypasses MFA on 340+ orgs

Microsoft disrupted Fox Tempest malware-signing service; Drupal critical patches May 20; OAuth phishing bypasses MFA on 340+ Microsoft 365 organizations. CVE-2026-31635 Linux PoC public.

Microsoft Exchange zero-day in active use; npm worm clones spread after source leak

Microsoft Exchange zero-day under active exploitation with no patch available. Shai-Hulud worm source code leaked, spawning clones targeting npm developers. INTERPOL Operation Ramz arrested 201 cybercriminals across MENA region.

Zero-days exploited: NGINX, MS Exchange, Cisco SD-WAN; TanStack hit

Critical zero-days in NGINX, Microsoft Exchange, and Cisco SD-WAN actively exploited in the wild. TanStack supply chain attack compromises OpenAI and AI companies. Immediate patching required.

Critical RCEs exploited: Cisco SD-WAN, Exchange, Funnel Builder

Critical vulnerabilities in Cisco SD-WAN (CVSS 10.0), Microsoft Exchange, and Funnel Builder WordPress plugin under active exploitation. Supply chain attacks compromise npm packages. Immediate patching required.

MS Exchange zero-day exploited; npm hits OpenAI; Turla evolves Kazuar

Critical Microsoft Exchange zero-day exploited in wild; npm supply chain attacks compromise OpenAI; Turla APT evolves Kazuar into P2P botnet; WordPress plugins actively harvesting payment cards.

Cisco SD-WAN zero-day exploited; TanStack supply-chain hits OpenAI

Critical Cisco SD-WAN zero-day exploited in the wild; supply chain attacks compromise TanStack and node-ipc; state APTs target government; education platform disrupted by extortion.

BitLocker zero-day PoCs public; Exchange APT; Foxconn breached

Critical BitLocker zero-days with public PoCs, Microsoft Exchange APT exploitation, Canvas ransomware attack on education sector, and Foxconn manufacturing compromise create immediate operational risks across multiple industries.

Checkmarx Jenkins compromise; AI-generated zero-day 2FA bypass

Critical supply chain compromise of Checkmarx Jenkins plugin, first AI-generated zero-day 2FA bypass exploit, and active Canvas education platform extortion campaign require immediate response.

Palo Alto & Ivanti EPMM RCE exploited; PCPJack worm hits cloud

Critical vulnerabilities in Palo Alto Networks and Ivanti EPMM under active exploitation. PCPJack credential stealer worm targeting cloud infrastructure. Russian state actors harvesting Office tokens via router compromise.

vm2, Palo Alto, DAEMON Tools exploited; Iran APT false-flag operations

Critical vulnerabilities in vm2, Palo Alto firewalls, and DAEMON Tools combined with Russian military intelligence token harvesting and Iranian APT false-flag campaigns demand immediate patching and investigation.

Apache HTTP/2 & MetInfo exploited; DAEMON Tools supply-chain hit

Critical vulnerabilities in Apache HTTP/2 and MetInfo CMS, supply-chain compromise of DAEMON Tools, and persistent OAuth backdoors require immediate response.

cPanel & MOVEit exploited; RMM phishing hits 80+ organizations

Critical vulnerabilities in cPanel and MOVEit, widespread RMM-based phishing compromising 80+ organizations, and supply-chain malware in PyTorch Lightning demand immediate patching and credential rotation.

Linux root vulnerability in KEV; cPanel mass-exploitation continues

Critical Linux root access vulnerability added to CISA KEV with active exploitation confirmed. Multiple critical threats including cPanel mass-exploitation, source code breaches, and state-sponsored APT campaigns.

cPanel RCE ransomware; 30K Facebook hacked; Trellix source leaked

Critical cPanel RCE exploited for ransomware; Russian military harvesting Office tokens; 30K Facebook accounts compromised; Trellix source code breached; automated Azure OAuth attacks.

cPanel auth bypass; state token harvesting; SaaS extortion attacks

Critical vulnerabilities, state-sponsored token harvesting, large-scale phishing operations, and coordinated SaaS extortion attacks demand immediate defensive action across government and technology sectors.

PyTorch Lightning & SAP supply-chain; AI cuts attack time to 24h

Critical supply chain attacks compromise PyTorch Lightning and SAP packages; Russian state-sponsored actors steal Office tokens; AI-accelerated exploitation shrinks time-to-compromise to 24 hours.

GitHub, Hugging Face RCE; VECT 2.0 ransomware; BlueNoroff deepfakes

Critical RCE vulnerabilities in GitHub and Hugging Face, destructive VECT 2.0 ransomware, Russian token harvesting, and BlueNoroff deepfake attacks demand immediate defensive action.

Docker & npm supply-chain hits; Lotus Wiper on Venezuelan energy

Critical supply chain attacks via malicious Docker images and npm worms, state-sponsored credential theft campaigns targeting Microsoft Office, and destructive Lotus Wiper malware deployed against Venezuelan energy infrastructure require immediate response across all organizations.

Russian APT token theft; Gentlemen ransomware claims 1,570 victims

Russian state-backed APT harvesting Microsoft tokens, 1,570+ Gentlemen ransomware victims, critical SD-WAN and RMM exploits, Windows Defender flaws—urgent patching required across infrastructure.

SGLang & Anthropic MCP RCE; APT campaigns hit OT/healthcare auth

Critical RCE vulnerabilities in AI infrastructure (SGLang, Anthropic MCP) combined with state-sponsored APT campaigns targeting authentication systems and OT/healthcare infrastructure demand immediate patching and access controls.

Microsoft Defender & ActiveMQ zero-days under exploitation

Critical zero-day exploits in Microsoft Defender and Apache ActiveMQ, Russian state-sponsored token harvesting, and sophisticated ransomware evasion techniques pose immediate threats requiring emergency patching and threat hunting.

Apache ActiveMQ exploited; Defender zero-day; ZionSiphon hits water

Apache ActiveMQ actively exploited; Microsoft Defender zero-day disclosed; Russian state actors harvesting Office 365 tokens; ZionSiphon targets water infrastructure.

nginx-ui auth bypass exploited; SharePoint zero-day in 169 patches

Critical nginx-ui authentication bypass actively exploited; Microsoft releases 169 patches including SharePoint zero-day; n8n webhooks weaponized for phishing; WordPress plugins and signed software compromised.

Microsoft zero-days exploited; Mirax RAT hits 220K; PHP supply chain

Critical Microsoft zero-days under exploitation, Russian state hackers harvesting Office tokens via routers, and 220K users compromised by Mirax RAT. Supply-chain risks escalating across PHP and development ecosystems.

Adobe Reader zero-day; CPUID STX RAT supply-chain; Iran hits 4,000 ICS

Critical Adobe Reader zero-day, CPUID supply-chain compromise distributing STX RAT, Russian APT harvesting Office tokens via router exploits, and Iranian actors targeting 4,000+ U.S. industrial control systems.

Iran PLC attacks; Marimo RCE exploited in 10h; GlassWorm IDE infection

Critical threats span Iranian PLC targeting, Russian token harvesting, Marimo RCE exploitation within 10 hours, and GlassWorm IDE infections. Immediate patching and detection deployment required.

Marimo RCE exploited; Iran targets 4,000 US PLCs; Russian token theft

Critical exploitation of Marimo RCE, Iranian targeting of 4,000 US PLCs, and Russian token harvesting via routers demand immediate patching and access controls.

Iran & DPRK target Microsoft 365; GitHub C2 supply-chain attacks

State-sponsored APT campaigns targeting Microsoft 365 and supply chains escalate with GitHub C2 usage and zero-day exploits deployed within 24 hours of breach.

FortiClient RCE exploited; DPRK & Chinese APTs hit EU institutions

State-sponsored DPRK and China-linked APT campaigns, critical FortiClient RCE exploit, and cascading supply chain attacks affecting European institutions and npm ecosystem.

Next.js exploited; Cisco IMC, ShareFile flaws patched; $280M DPRK theft

Next.js React2Shell flaw actively exploited; critical Cisco IMC, Progress ShareFile flaws patched; $280M cryptocurrency theft attributed to North Korea; credential harvesting impacts 766 hosts

Chrome & TrueConf zero-days exploited; widespread malware campaigns

Critical zero-day vulnerabilities in Chrome and TrueConf under active exploitation, combined with widespread malware campaigns targeting mobile and enterprise infrastructure.

TrueConf zero-day exploited; North Korea Axios npm compromise

Critical zero-day exploits in TrueConf and North Korean Axios compromise, plus wiper attacks and AI platform over-privilege vulnerabilities demand immediate response across cloud, government, and healthcare sectors.

Citrix exploited; Axios npm RAT supply-chain; OpenAI data theft

Critical Citrix vulnerability actively exploited, Axios npm supply chain attack spreading RAT, OpenAI vulnerabilities enabling data theft, state-sponsored APT operations escalating against telecom and healthcare sectors

FBI Director email breached; Citrix & F5 zero-days exploited

FBI Director's email breached by Iran-linked hackers; critical Citrix and F5 vulnerabilities under active exploitation; wiper attacks target Stryker; nation-state exploit kits leaked publicly.

Iran breaches FBI Director email; Citrix & F5 zero-days unpatched

Iran-linked actors breached FBI Director Kash Patel's email and launched wiper attacks on Stryker. Critical Citrix and F5 vulnerabilities under active exploitation with no patches available.

Chinese APT in telecom backbone; Langflow zero-day exploited

State-sponsored Chinese APT embedded in telecom backbone, critical Langflow AI vulnerability actively exploited, wiper malware targeting Iran systems, and zero-click AI assistant vulnerabilities require immediate response.

Oracle RCE exploited; Iran wiper hits healthcare; Trivy worm spreads

Critical Oracle RCE, Russian state-sponsored phishing, Trivy supply-chain worm, and Iran-backed healthcare wiper attacks demand immediate emergency response and patching across enterprise infrastructure.

Oracle Identity Manager, Langflow exploited; Trivy supply-chain worm

Critical vulnerabilities in Oracle Identity Manager and Langflow actively exploited; Trivy supply chain attack escalates with CanisterWorm across 47 npm packages; Russian intelligence phishing campaigns compromise thousands.