Daily briefings on critical security disclosures, vulnerabilities, and threat intelligence.
Citizen Lab revealed that Israeli ad-tech vendor Discover-Tech abused programmatic real-time bidding auctions via its Controlium platform to deploy Candiru zero-click mercenary spyware against media organizations, triggering device compromises upon ad rendering without user interaction.
Read briefing →BeyondTrust has patched a critical zero-day vulnerability (CVE-2026-102764) in Remote Support actively exploited since August by China-nexus group ARMORY CASTLE to deploy SAWFLY webshells, escalate to root, and tunnel traffic via BARECLAW.
Read briefing →Threat actors are actively exploiting a critical command injection flaw (CVE-2026-110447) in the Collabora Online Built-in CODE Server app for Nextcloud, planting persistent PHP web shells to hijack servers and exfiltrate credentials whenever the document engine restarts.
Read briefing →The US Department of Justice unsealed an indictment against two Sudanese nationals for operating Anonymous Sudan, while federal authorities and industry partners seized the Godzilla and InfraShutdown attack clusters responsible for over 35,000 distributed denial-of-service attacks.
Read briefing →North Korean threat group ScarCruft weaponized a zero-day type confusion flaw in the Internet Explorer scripting engine (CVE-2024-38178) via compromised advertising networks to deploy RokRAT malware through zero-click desktop toast notifications.
Read briefing →Security researchers demonstrated how threat actors weaponize entry point configurations across PyPI, npm, and open-source registries to execute command-jacking and stealth command-wrapping attacks that hijack developer tooling and bypass install-time security controls.
Read briefing →Automattic issued security updates across 101 versions of the Jetpack WordPress plugin to address an authorization bypass flaw (CVE-2024-9926) in the Contact Form REST API that allowed low-privileged users to access private visitor form submissions.
Read briefing →Splunk patched high-severity vulnerabilities in Splunk Enterprise for Windows, including an insecure session storage flaw (CVE-2024-45733) enabling remote code execution and an arbitrary file write defect (CVE-2024-45731) allowing system root compromise.
Read briefing →Security researchers discovered 40 new variants of the TrickMo Android banking trojan that tamper with ZIP archive headers to evade static analysis and deploy deceptive full-screen overlays to capture device PINs and unlock patterns for automated on-device fraud.
Read briefing →Cisco launched an investigation and took its DevHub portal offline after threat actor IntelBroker leaked stolen repositories, API tokens, and customer automation scripts obtained via misconfigured public access controls on the developer resource center.
Read briefing →