Expert analysis and threat intelligence updates for security leaders
Threat intelligence across vulnerabilities and attacks, combined with independent analysis of leading cybersecurity platforms and vendors.
Track CVEs and zero-day exploits
Enterprise ransomware campaigns
Cloud platform threats and risks
AI attack surface and LLM threats
Major breach incidents and lessons
Nation-state espionage campaigns
Social engineering and BEC attacks
OT and ICS security threats
Practical guidance for CISOs
Vendor IntelligenceEnterprise Microsoft security ecosystem including Defender, Sentinel, Azure security and zero-day vulnerabilities.
Vendor IntelligenceFalcon platform analysis, threat intelligence and enterprise incident response.
Vendor IntelligenceWiz cloud security platform insights and threat analysis.
CVE-2026-42533 is a critical heap buffer overflow in NGINX enabling remote code execution and denial of service. Patch all affected servers by July 15, 2026.
Medibank Private suffered a ransomware breach attributed to REvil, with Armenia detaining a Russian tourist allegedly linked to the attack. The incident underscores ongoing international law enforcement efforts and potential mistaken identity concerns.
This week's top 15 cybersecurity incidents. Zero-days, SaaS misconfigurations, and ransomware dominate global threat activity.
CVE-2008-4128 and CVE-2018-0171 are high-severity Cisco router vulnerabilities exploited for remote code execution; patch immediately to prevent compromise.
CVE-2026-58644 is a critical SharePoint vulnerability enabling remote code execution, now under active exploitation. Immediate patching is mandated by CISA.
Land and Agricultural Development Bank of South Africa and 186 other government organizations were hit by ransomware, causing widespread service disruption. Notably, attackers demanded $3.1 million from the South African bank.
CVE-2025-40948, CVE-2025-40947, and CVE-2025-40949 are critical zero-days in Siemens ROX II OT switches enabling root access; patch immediately or isolate affected devices.
CVE-2026-39987 and CVE-2026-41176 (high severity) are exploited by the NadMesh botnet to steal cloud credentials and Kubernetes tokens from exposed AI services. Immediate patching is critical to prevent unauthorized infrastructure access.
Thyssenkrupp Marine Systems and its subsidiary Atlas Elektronik suffered a ransomware attack by The Gentlemen, resulting in over 1TB of data exfiltrated. The breach was contained to an isolated North American unit, limiting classified data exposure.
CVE-2026-59208 is a high-severity flaw in n8n’s Enterprise token exchange, allowing attackers to impersonate users across trusted issuers. Patch released June 24, 2026.
CVE-2026-20296, CVE-2026-20297, CVE-2026-20298, and CVE-2026-53412 are critical flaws in Splunk and Zoom, enabling credential theft and account takeover. Immediate patching is required.
Transport for London suffered a critical ransomware attack in 2024, compromising personal and financial data of 5,000 individuals and disrupting 148 systems. Attackers Owen Flowers and Thalha Jubair were sentenced to 5.5 years for their roles.
CVE-2026-6875 is a critical unauthenticated remote code execution vulnerability in ServiceNow’s AI platform. Immediate patching is required to prevent exploitation.
CVE-2026-15409 and CVE-2026-15410 are critical zero-days in SonicWall SMA 1000, enabling admin-level command execution and SSRF. Patching is mandatory and urgent.
Progress has directed ShareFile customers to immediately shut down Storage Zone Controllers following a credible ransomware threat. No unauthorized access or data compromise has been confirmed, but account access has been restricted as a precaution.
CVE-2026-44747 is a critical (CVSS 9.9) out-of-bounds write vulnerability in SAP NetWeaver Application Server ABAP, patched in July 2026. Immediate patching is required to prevent memory corruption and potential data breaches.
CVE-2026-56164 and CVE-2026-56155 are critical Microsoft zero-days under active attack, enabling privilege escalation in SharePoint Server and AD FS. Immediate patching is mandatory due to confirmed exploitation.
Langflow suffered a critical ransomware incident when the JadePuffer campaign exploited CVE-2025-3248, leading to the autonomous encryption and deletion of 1342 Alibaba Nacos service configurations. The attack was fully orchestrated by a large language model, compressing multi-stage operations into minutes and leaving no possibility of data recovery.
CVE-2018-0171 and CVE-2008-4128 are critical Cisco Smart Install flaws actively exploited by Russian state-linked actors; patch all affected devices immediately.
CVE-2025-32711 is a high-severity flaw in OpenClaw AI agents allowing persistent memory poisoning via a single email. Patch or mitigate immediately.
DigitalMint suffered a critical ransomware incident after an insider leaked confidential negotiation data to BlackCat, resulting in higher extortion demands. The breach also implicated Sygnia Cybersecurity Services and led to $1.2 million in losses.
CVE-2026-XXXXX is a critical UniFi vulnerability allowing remote code execution and denial of service. Ubiquiti has released urgent patches; update immediately.
CVE-2023-24489 is a high-severity vulnerability impacting Progress ShareFile Storage Zone Controllers, prompting an urgent shutdown directive. No patch or workaround is currently available; immediate action is required.
Multiple U.S. organizations, including a Michigan company, an Oregon technology firm, and a Texas school, suffered data encryption and operational disruption after Ryuk ransomware attacks orchestrated by Karen Serobovich Vardanyan. Victims paid over $15 million in Bitcoin ransoms.
This week's top 14 cybersecurity incidents. Destructive malware and insider-enabled ransomware attacks dominated, with critical supply chain and data breach exposures.
CVE-2020-22653, CVE-2020-22658, CVE-2023-25717, and CVE-2025-2492 are high-severity router vulnerabilities exploited by UAT-7810 for persistent access. Patch all affected devices immediately.
CVE-2026-39861 (High) enables silent execution of attacker-supplied code via Anthropic Claude Code and OpenAI Codex in autonomous review modes. Patch or disable autonomous execution immediately.
Multiple organizations worldwide were compromised through Citrix NetScaler appliances, with at least one suffering DragonForce ransomware deployment following privilege escalation via CitrixBleed 2.
CVE-2026-3844 (CVSS: High) enables remote attackers to deploy persistent webshells via the WordPress Breeze plugin. Exploitation is active; patch immediately.
CVE-2016-6329 and CVE-2016-2183 (high severity) expose over 2.4 billion installs of free Android VPN apps to DNS leaks, tunnel hijacking, and plaintext data interception. Immediate removal or patching is advised; no vendor patch deadline announced.