Expert analysis and threat intelligence updates for security leaders
Threat intelligence across vulnerabilities and attacks, combined with independent analysis of leading cybersecurity platforms and vendors.
Track CVEs and zero-day exploits
Enterprise ransomware campaigns
Cloud platform threats and risks
AI attack surface and LLM threats
Major breach incidents and lessons
Nation-state espionage campaigns
Social engineering and BEC attacks
OT and ICS security threats
Practical guidance for CISOs
Vendor IntelligenceEnterprise Microsoft security ecosystem including Defender, Sentinel, Azure security and zero-day vulnerabilities.
Vendor IntelligenceFalcon platform analysis, threat intelligence and enterprise incident response.
Vendor IntelligenceWiz cloud security platform insights and threat analysis.
CVE-2016-6329 and CVE-2016-2183 (high severity) expose over 2.4 billion installs of free Android VPN apps to DNS leaks, tunnel hijacking, and plaintext data interception. Immediate removal or patching is advised; no vendor patch deadline announced.
The Gentlemen ransomware group compromised over 580 organizations worldwide, including 103 manufacturing firms, using custom malware and zero-day exploits. Their attacks caused widespread operational disruption and leveraged a Ransomware-as-a-Service model.
CVE-2026-39861 is a high-severity flaw in Anthropic and OpenAI AI coding agents that enables arbitrary code execution when scanning untrusted projects. No patch is available; immediate mitigation is required.
CVE-2026-43499 is a high-severity Linux kernel vulnerability enabling local privilege escalation and container escape; patch all affected systems immediately.
A targeted organization suffered a GodDamn ransomware attack in June 2026, with threat actors using the PoisonX driver to disable endpoint defenses and facilitate widespread data encryption.
CVE-2026-43499 is a high-severity (CVSS 7.8) Linux kernel flaw enabling local privilege escalation and container escape. Patch all affected systems immediately; fixes released April 2026.
CVE-2026-48282, CVE-2026-55255, CVE-2026-33017, CVE-2026-48908, and CVE-2026-56290 are critical vulnerabilities under active exploitation in Adobe ColdFusion, Langflow, and Joomla extensions. CISA mandates patching by July 10, 2026.
Bandai Channel suffered a critical ransomware attack orchestrated by the autonomous AI JadePuffer, resulting in service disruption and nearly 47,000 anime streaming subscriptions being cancelled. The incident marks a significant escalation in the use of AI for fully automated cyberattacks.
CVE-2026-25373 is a high-severity Windows shortcut vulnerability exploited in the wild by Armored Likho APT to deploy AI-generated malware. Immediate patching is critical to prevent credential theft and persistent network compromise.
CVE-2026-40138, CVE-2026-40139, CVE-2026-40140, and CVE-2026-40141 are critical authentication bypass vulnerabilities in BeyondTrust Remote Support and Privileged Remote Access (≤25.3.2). Patch immediately to prevent unauthorized access.
Union County, Ohio suffered a ransomware attack by the Kairos group, resulting in the theft of over 2TB of sensitive data. The county paid $1 million in Bitcoin to prevent public release of information affecting 45,487 individuals.
CVE-2025-3248 (critical) enables full compromise of Langflow instances, exploited in a JadePuffer ransomware attack causing unrecoverable Nacos data loss. Patch immediately.
CVE-2026-46242 (high severity) enables local root privilege escalation on Linux kernel 6.4+ and Google Pixel 10 via a released proof-of-concept exploit. Patch immediately to prevent compromise.
Sysdig was impacted by JadePuffer, the first AI-driven ransomware attack, which encrypted over 1,300 configuration records and stole credentials. The AI agent autonomously exploited vulnerabilities, raising new concerns about attack scalability.
CVE-2026-50548 and CVE-2026-50549 are critical flaws in Cursor AI's code editor enabling remote OS-level code execution. Patch to v3.0 immediately.
CVE-2026-26128 is a high-severity Kerberos protocol flaw enabling reflection attacks and authentication bypass. Patch as soon as vendor guidance is available.
Qilin, a ransomware-as-a-service operation, has rapidly become the dominant ransomware group, compromising nearly 1,500 organizations over the past year. The group’s mature infrastructure and aggressive tactics have led to significant disruption and increased law enforcement scrutiny.
This week's top 15 cybersecurity incidents. Zero-day exploitation and large-scale data breaches dominated, with critical vulnerabilities and supply chain attacks targeting core infrastructure and developer environments.
CVE-2026-33634, CVE-2026-48027, CVE-2026-45321, and CVE-2025-55182 are critical supply chain vulnerabilities exploited by TeamPCP to steal cloud credentials via trojanized developer tools. No official patch timeline; immediate investigation and tool integrity validation required.
CVE-2017-17215, CVE-2025-29635, CVE-2024-1781, and CVE-2018-8007 (high severity) are being actively exploited by the RustDuck botnet to hijack routers and servers for DDoS attacks. Immediate patching is critical to prevent device compromise.
Blackpoint Cyber was targeted by the Avalon malware framework, which deployed CrownX ransomware via multi-stage phishing. Attackers exfiltrated credentials and cryptocurrency wallets, disrupted recovery, and demanded escalating ransom.
CVE-2026-8451 is a high-severity memory overread flaw in Citrix NetScaler appliances, confirmed exploited within 24 hours of patch release. Immediate patching is required to prevent device compromise.
CVE-2026-6682 and six related high-severity flaws in FatFs allow memory corruption and code execution on embedded devices. No upstream patches are available; downstream vendors must act immediately.
A luxury jewelry retailer suffered a ransomware attack by Scattered Spider in May 2025, resulting in $2 million in losses from business disruption. The group demanded an $8 million ransom, which was not paid.
CVE-2026-55200 and related critical CVEs impact Libssh2, Linux kernel, and major open-source projects, enabling remote code execution and privilege escalation. Immediate patching is mandatory; some vulnerabilities remain unpatched and are under active exploitation.
CVE-2026-14191 (high severity) enables remote code execution in WinRAR via crafted .rev files. Patch to version 7.23 immediately; no auto-update available.
Fortinet suffered a critical breach as the FortiBleed campaign enabled large-scale credential theft from FortiGate firewalls. Stolen credentials were weaponized by INC and Lynx ransomware groups, resulting in widespread endpoint encryption.
CVE-2026-8451, CVE-2026-8452, CVE-2026-8655, CVE-2026-10816, CVE-2026-49975, and CVE-2026-13474 are high-severity flaws in Citrix NetScaler ADC and Gateway. Immediate patching is required to prevent denial-of-service and information disclosure.
CVE-2026-8037 is a critical pre-auth remote code execution flaw in Progress Kemp LoadMaster under active exploitation. Patch immediately to prevent compromise.
Check Point Research identified InfernoGrabber v9.0, an AI-generated browser ransomware abusing Chromium APIs to encrypt and steal data. The attack leverages the File System Access API on Windows and Android, exposing a new browser-native ransomware vector.