Daily briefings on critical security disclosures, vulnerabilities, and threat intelligence.
The PHP development team has released emergency security updates addressing two critical vulnerabilities dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), which allow unauthenticated remote attackers to execute arbitrary code or exfiltrate worker memory across core PHP runtimes.
Read briefing →North Korean state-sponsored threat group Lazarus exploited a Google Chrome zero-day vulnerability, CVE-2024-4947, via a deceptive Web3 game website to execute arbitrary code and deploy Manuscrypt malware against cryptocurrency targets.
Read briefing →A public proof-of-concept exploit has been released for CVE-2024-43532, an elevation of privilege flaw in Windows Remote Registry that insecurely falls back to unverified RPC transports, allowing attackers to relay NTLM credentials to Active Directory Certificate Services for domain takeover.
Read briefing →Bumblebee malware has resurfaced in new spear-phishing campaigns four months after international law enforcement disrupted its infrastructure in Operation Endgame, adopting stealthy MSI installers to execute payloads directly in memory.
Read briefing →Threat actors are actively exploiting CVE-2024-37383, a stored cross-site scripting vulnerability in Roundcube Webmail, to execute malicious JavaScript via crafted SVG elements, harvest user credentials, and exfiltrate emails from government targets.
Read briefing →Threat actors are actively exploiting CVE-2024-38094, a high-severity deserialization flaw in on-premises Microsoft SharePoint Server, to breach corporate networks, deploy web shells, hijack Exchange service accounts, and neutralize endpoint defenses.
Read briefing →Researchers from ETH Zurich disclosed Post-Barrier Spectre attacks bypassing Indirect Branch Predictor Barrier defenses on modern Intel and AMD processors under Linux, enabling local unprivileged actors to leak root hashes and kernel memory.
Read briefing →Threat actors compromised Comsecure, ESET's exclusive distributor in Israel, abusing authenticated mail servers to distribute a destructive data wiper disguised as a security tool named ESET Unleashed.
Read briefing →Microsoft disclosed a critical macOS Transparency, Consent, and Control bypass dubbed HM Surf (CVE-2024-44133), which abuses Safari private entitlements and directory path manipulation to silently access cameras, microphones, and location data, with observed exploitation by Adload malware.
Read briefing →A joint advisory from CISA, the FBI, and international allies warned that Iranian state-sponsored cyber actors are weaponizing password spraying and MFA push bombing to breach critical infrastructure, monetizing stolen credentials and network access on underground cybercriminal forums.
Read briefing →