Daily briefings on critical security disclosures, vulnerabilities, and threat intelligence.
An international law enforcement coalition led by the Dutch Police and FBI dismantled the global infrastructure of the RedLine and Meta infostealers under Operation Magnus, seizing command servers, source code, and customer databases while unsealing US charges against a key developer.
Read briefing →French telecommunications provider Free confirmed a major cyberattack compromising an internal management tool, exposing personal records for 19.2 million customers and 5.11 million IBAN numbers to threat actor drussellx on BreachForums.
Read briefing →A newly analyzed UEFI bootkit named BlackX, linked to Chinese threat actor APT41, exploits the Baton Drop flaw (CVE-2022-21894) to bypass Secure Boot on fully patched Windows endpoints, neutralizing security telemetry and deploying persistent espionage implants.
Read briefing →A critical unauthenticated remote code execution vulnerability chain in CyberPanel (CVE-2024-51567) is being mass-exploited in the wild, enabling threat actors to gain root privileges and encrypt over 22,000 servers with PSAUX ransomware.
Read briefing →Security researchers demonstrated a Windows Driver Signature Enforcement bypass that abuses the Windows Update architecture to downgrade Code Integrity components, resurrecting patched vulnerabilities to load unsigned drivers and persistent kernel rootkits.
Read briefing →Black Basta ransomware affiliates are breaching corporate networks by combining automated email bombing with deceptive Microsoft Teams messages posing as IT support, coercing employees into launching remote access tools like Windows Quick Assist to deploy malware.
Read briefing →Amazon seized domains used by Russian state-sponsored actor APT29 in a global spear-phishing campaign that weaponized digitally signed Remote Desktop Protocol configuration files and client device redirection to covertly exfiltrate credentials and sensitive files without executing malware on target hosts.
Read briefing →The Node.js project has released emergency security updates addressing a critical remote code execution vulnerability dubbed Node2Shell (CVE-2026-111497) in its bundled Brotli decompression library, allowing unauthenticated attackers to execute arbitrary code via malformed payload streams.
Read briefing →Cisco released security updates addressing CVE-2024-20481, an actively exploited resource exhaustion vulnerability in the Remote Access VPN service of ASA and Firepower Threat Defense software that enables unauthenticated remote attackers to trigger persistent denial-of-service conditions.
Read briefing →Synology issued emergency patches addressing CVE-2024-10443, a maximum-severity zero-click command injection vulnerability dubbed RISK:STATION in Synology Photos and BeePhotos that allows unauthenticated remote attackers to execute arbitrary code as root on internet-exposed NAS appliances.
Read briefing →