Expert analysis and threat intelligence updates for security leaders
Threat intelligence across vulnerabilities and attacks, combined with independent analysis of leading cybersecurity platforms and vendors.
Track CVEs and zero-day exploits
Enterprise ransomware campaigns
Cloud platform threats and risks
AI attack surface and LLM threats
Major breach incidents and lessons
Nation-state espionage campaigns
Social engineering and BEC attacks
OT and ICS security threats
Practical guidance for CISOs
Vendor IntelligenceEnterprise Microsoft security ecosystem including Defender, Sentinel, Azure security and zero-day vulnerabilities.
Vendor IntelligenceFalcon platform analysis, threat intelligence and enterprise incident response.
Vendor IntelligenceWiz cloud security platform insights and threat analysis.
This week's top 15 cybersecurity incidents. Legacy vulnerabilities and AI-driven attacks dominate, with critical exposures in Wi-Fi infrastructure, WAFs, and data portals.
CVE-2025-41451 and CVE-2025-41452 (high severity) enable remote exploitation of Danfoss, Copeland, and Dixell refrigeration controllers. Immediate patching is critical to prevent physical damage and fire risk.
Victory Personal Care, Inc, a US-based retail company, suffered a high-severity ransomware attack attributed to Nightspire. Details of the affected data and operational impact remain undisclosed.
CVE-2025-61882 is a high-severity zero-day in Oracle E-Business Suite, exploited in the wild by Cl0p to breach Estée Lauder in August 2025. Immediate patching is critical.
CVE-2026-15409 and CVE-2026-15410 are critical zero-days in SonicWall SMA 1000 VPN appliances, exploited for root access and credential theft since June 2026. Immediate patching is mandatory.
An unnamed telecommunications managed service provider suffered a high-severity breach in September 2024, where attackers exploited FortiManager vulnerabilities to exfiltrate sensitive data and deploy memory-resident malware. Over 500 managed FortiGate firewalls were compromised, exposing critical infrastructure and client communications.
CVE-2026-29059 is a high-severity unauthenticated path traversal flaw in Windmill, actively exploited to read arbitrary server files. Patch immediately to prevent credential theft and code execution.
CVE-2026-50522 is a critical remote code execution vulnerability in Microsoft SharePoint, actively exploited to steal machine keys and maintain persistent access. Patch released July 14, 2026; immediate action required.
Intermarché, Netto, Coopérative U, Carrefour, E.Leclerc, and Monoprix suffered a ransomware attack that compromised refrigeration-control systems, leading to widespread food spoilage and equipment damage.
CVE-2026-88771, CVE-2026-88772, CVE-2026-88779, and CVE-2026-107406 are critical, actively exploited Citrix NetScaler ADC/Gateway vulnerabilities enabling remote code execution and persistent compromise. Immediate patching is mandatory.
CVE-2026-90817 is a high-severity REDCap vulnerability enabling remote code execution, now exploited in active Monero mining attacks. Immediate patching is critical.
Fortinet firewalls globally were compromised in the FortiBleed campaign, with over 86,000 devices locked and admin access disabled. Attackers leveraged leaked credentials to facilitate ransomware affiliate access.
CVE-2024-36401 is a high-severity GeoServer vulnerability enabling remote code execution, now exploited in active Rondo botnet attacks. Patch immediately to prevent compromise.
CVE-2026-8933 is a high-severity local privilege escalation in Ubuntu's snap-confine, allowing root access via race condition; patch immediately.
Palo Alto Networks suffered a ransomware incident exploiting CVE-2026-0257, targeting GlobalProtect VPN. Attackers gained unauthorized access to VPN sessions, risking data compromise.
This week's top 15 cybersecurity incidents. Credential compromise and supply chain attacks dominate, with global infrastructure and major tech platforms targeted.
CVE-2026-41940 (high severity) enables remote attackers to bypass authentication on cPanel and WHM servers via malicious GitHub Actions workflows. Immediate patching is critical to prevent credential theft.
CVE-2026-10520 and CVE-2026-42271 (high severity) enable the PoeLLM botnet to compromise AI and development servers for cryptomining. Immediate patching is critical to prevent further exploitation.
MonsterCloud, a Florida-based ransomware recovery firm, was compromised when its owner was charged with fraud for secretly paying attackers and overcharging clients. The scheme involved over $19 million in client fees while only $8 million was paid to ransomware operators.
CVE-2026-48294 (high severity) enables attackers to access WhatsApp Web chats via the Adobe Acrobat PDF Chrome extension. Patch to version 26.5.2.3 immediately.
CVE-2026-35273 is a critical, actively exploited zero-day in Oracle PeopleSoft, used by ShinyHunters to breach FBI employee data. No patch or mitigation is available as of June 2026.
Fortinet FortiGate firewalls were compromised in a global ransomware campaign, with over 86,000 devices locked out due to credential harvesting and brute-force attacks. Attackers established persistent administrative access, enabling ransomware deployment by groups including INC, Lynx, and Payload.
CVE-2026-0768 is a critical zero-day in Langflow AI App Builder enabling unauthenticated root-level code execution; active exploitation began August 29, 2026. Immediate patching is required to prevent credential theft and lateral movement.
Fairlife, a Coca-Cola subsidiary, suffered a ransomware attack in July 2026 that forced a temporary halt in dairy production. The incident raised broader national security concerns due to its context within a coordinated campaign targeting U.S. critical infrastructure.
CVE-2021-22681 (CVSS: High) enables attackers to bypass authentication in Schneider Electric products. Active exploitation reported in June 2026. Patch immediately.
CVE-2026-88779 is a high-severity Citrix NetScaler flaw enabling denial of service and webshell deployment, actively exploited in the wild. CISA mandates immediate patching.
OTEIS Conseil & Ingénierie, a French engineering and consulting firm, was targeted by the coinbasecartel ransomware group in August 2026. The attack likely disrupted operations and compromised data integrity.
CVE-2026-16232 is a critical authentication bypass (CVSS 9.3) in Check Point Security Management, actively exploited in the wild. Patch immediately to prevent full admin compromise.
CVE-2026-58593 (high severity) exposes NodeBB forums to admin takeover, private data leaks, and code execution. Patch to 4.14.2 immediately.
Navitrans, a Colombian distributor in the commercial truck and heavy machinery sector, was targeted by the Emperador ransomware group. Attackers exfiltrated 223.2 MB of sensitive pricing, financing, and operational data, exposing the company to financial and reputational risks.