Daily briefings on critical security disclosures, vulnerabilities, and threat intelligence.
ConnectWise addressed a critical vulnerability (CVE-2026-84869) in ScreenConnect that allows unauthorized attackers to transfer and execute arbitrary files during active remote sessions, which is now actively exploited in worm-like attacks.
Read briefing →Cisco issued emergency updates for an actively exploited zero-day vulnerability, CVE-2026-76461, in AsyncOS for Cisco Secure Email Gateway that allows unauthenticated remote attackers to execute arbitrary commands with root privileges via crafted email parsing.
Read briefing →Suspected China-aligned threat actor Red Heron exploited a critical Gitea remote code execution vulnerability (CVE-2026-60004) to compromise 13 organizations across six countries, deploying the JITTERLY implant and SIXZUT LD_PRELOAD rootkit for long-term persistence.
Read briefing →Threat actors Storm-3032 and Storm-3121 are deploying targeted voice and SMS phishing lures themed around passkey enrollment to guide enterprise targets through AitM and OAuth device-code flows, registering rogue MFA methods in Entra ID to harvest data via Microsoft Graph APIs.
Read briefing →China-linked threat group UNC3569 weaponized a custom URI scheme flaw in Sogou Input Method to deploy the GRAYRABBIT backdoor. The attack abused an unvalidated protocol handler and an un-sandboxed legacy Chromium engine to execute arbitrary code.
Read briefing →Anthropic revealed that extortion collective ShinyHunters, Russian APT Midnight Blizzard, and Chinese group GTG-10007 weaponized Claude agents to mass-harvest secrets from 1.8M Android apps, automate malware obfuscation loops, and orchestrate rapid cloud intrusions.
Read briefing →The Dutch NCSC has issued an urgent advisory warning of imminent exploitation targeting two CVSS 9.8 vulnerabilities in Check Point VPN gateways and management servers, enabling unauthenticated remote code execution via malformed certificates.
Read briefing →Threat actors are actively chaining JFrog Artifactory vulnerabilities CVE-2026-42018 and CVE-2026-42016 alongside CVE-2026-82329 to bypass authentication, forge administrative tokens, and deploy custom Rust backdoors on self-hosted instances.
Read briefing →GitLab issued emergency updates for a maximum-severity path traversal vulnerability, tracked as CVE-2026-85706, that allows unauthenticated remote attackers to read arbitrary files and sensitive secrets from exposed self-managed instances.
Read briefing →Cisco and CISA confirmed active in-the-wild exploitation of Cisco Secure FMC vulnerabilities CVE-2026-20079 and CVE-2026-20316, enabling root command execution and lateral network compromise by threat actors deploying Qilin ransomware.
Read briefing →