Expert analysis and threat intelligence updates for security leaders
Threat intelligence across vulnerabilities and attacks, combined with independent analysis of leading cybersecurity platforms and vendors.
Track CVEs and zero-day exploits
Enterprise ransomware campaigns
Cloud platform threats and risks
AI attack surface and LLM threats
Major breach incidents and lessons
Nation-state espionage campaigns
Social engineering and BEC attacks
OT and ICS security threats
Practical guidance for CISOs
Vendor IntelligenceEnterprise Microsoft security ecosystem including Defender, Sentinel, Azure security and zero-day vulnerabilities.
Vendor IntelligenceFalcon platform analysis, threat intelligence and enterprise incident response.
Vendor IntelligenceWiz cloud security platform insights and threat analysis.
CVE-2026-56164 and CVE-2026-50522 are high-severity Microsoft SharePoint vulnerabilities exploited in July 2026 to compromise 200 Swiss government accounts. Immediate patching is mandatory.
Four San Diego hospitals suffered a ransomware attack in 2021, crippling operations and causing severe patient care disruptions. The incident led to a 48% increase in wait times and a 128% rise in patients leaving without care.
CVE-2026-18830, CVE-2026-18236, CVE-2026-64650, and CVE-2026-64651 are high-severity flaws in AWS, Google, and Vercel agent SDKs allowing attackers to trigger tool execution without model invocation. Patches released mid-2026; immediate update required.
CVE-2026-63077 is a critical, actively exploited remote code execution flaw in JetBrains TeamCity on-premise servers. Immediate patching is required to prevent compromise of CI/CD pipelines.
Signature Services, a US-based professional services provider, suffered a ransomware attack attributed to the Play group, resulting in file encryption and operational disruption. The incident was publicly claimed by the attackers, though the organization has not confirmed details.
CVE-2026-18577 is a high-severity authentication bypass flaw in N-able N-central, actively exploited to compromise customer environments. Immediate patching is critical to prevent admin takeover and lateral movement.
CVE-2026-15409 and CVE-2026-15410 are critical SonicWall SMA 1000 zero-days exploited by INC Ransomware for privileged access and multi-channel extortion. Immediate patching is mandatory.
Preferred Financial Group suffered a ransomware attack attributed to the Play group, resulting in unauthorized access and operational disruption. The incident was publicly claimed by the threat actor, though the organization has not confirmed the breach.
CVE-2026-50522 is a high-severity Microsoft SharePoint vulnerability exploited in July 2026 to compromise 200 Swiss federal IT accounts. Patch immediately to prevent further breaches.
CVE-2026-58048 is a critical flaw in cPanel allowing authenticated users to execute SQL as database root. Patch immediately to prevent OS-level compromise.
Centro Universitário CESMAC in Brazil suffered a ransomware attack attributed to the krybit group, resulting in potential IT system encryption and service disruption. The incident was publicly claimed by the threat actor on their darknet blog.
CVE-2026-18577 (high severity) enables remote admin access to N-able N-central servers via authentication bypass; patch to build 2026.3.1.7 is mandatory to prevent persistent compromise.
CVE-2026-15409 and CVE-2026-15410 are critical SonicWall SMA1000 zero-days enabling root access and ransomware deployment; patch released July 14, 2026.
naskdoorinc.com, a US-based manufacturing company, suffered a ransomware attack by the safepay group, causing operational disruption across southeastern Pennsylvania and northern Delaware. The incident may involve data encryption or theft, though technical specifics remain unconfirmed.
CVE-2026-47876 (critical) enables VM escape on VMware ESXi, allowing local VM admins to execute code on the host. Patch immediately to prevent host takeover.
CVE-2026-59726 is a critical unauthenticated remote code execution flaw in Ruflo's AI agent orchestration platform. All self-hosted instances exposing port 3001 are at risk; immediate patching is mandatory.
Minnesota water utilities suffered a coordinated ransomware attack impacting over 30 organizations, including Braham and Plymouth Water Utilities. Attackers exploited exposed PLCs, resulting in operational outages and boil water notices.
This week's top 15 cybersecurity incidents. Ransomware and data breaches dominated, with critical infrastructure and supply chain attacks escalating.
CVE-2026-20316 (high severity) is a zero-day in Cisco Secure Firewall Management Center, actively exploited to access sensitive data. Cisco hotfixes must be applied by August 1, 2026.
CVE-2026-42897 is a critical Microsoft Exchange cross-site scripting flaw enabling persistent mailbox compromise. Exploited in the wild; patch immediately.
Vernon & Waldrep, a Texas-based healthcare organization, suffered a ransomware attack by Global Secret Group, resulting in the compromise of 274 GB of data. Over 56,000 files, including sensitive healthcare and mental health specialist information, were exposed.
CVE-2026-33017, CVE-2026-21858, and CVE-2025-68613 are high-severity flaws in Citrix NetScaler exploited in active attacks by a China-based actor. Immediate patching is critical.
CVE-2026-8233 (high severity) exposes 4G and 5G core networks to remote session hijacking and denial-of-service. Patch Dotouch systems immediately; remediation ongoing for other carriers.
MBM Law, a South Carolina-based law firm, suffered a ransomware attack attributed to the threat actor dragonforce. The incident resulted in operational disruption and a ransomware claim against the firm.
CVE-2026-42897 is a critical zero-day in Microsoft Exchange Outlook Web Access exploited in the wild to deploy persistent backdoors. Immediate patching is mandatory.
CVE-2026-33017 is a high-severity vulnerability exploited in the wild by a Chinese-speaking threat actor using autonomous AI-driven attack workflows. Immediate patching is critical to prevent automated exploitation.
L3Harris, a US-based aerospace and defense technology company, suffered operational disruption following a ransomware attack attributed to Kyber Group. The incident targeted US operations and was publicly claimed by the threat actor.
CVE-2026-10702 (high severity) enables remote code execution in Firefox and Tor Browser via a malicious webpage. Patch to 151.0.3 immediately.
CVE-2026-42897 is a critical zero-day in Microsoft Exchange OWA exploited in the wild for persistent mailbox access. Patch immediately to prevent credential theft.
Tong Kong E & E Sdn Bhd, a Malaysian manufacturing company, suffered a ransomware attack by Black X, resulting in the exposure of customer and banking records. The breach poses significant financial and reputational risks.