Every edition

Threat Intel & Breaches 13Vulns & Exploits 12Offensive Research 4Defense & AppSec 8DFIR 2AI Security 12Governance, Risk & Compliance 3Business & Boardroom 10

• Mind the (Patch) Gap, Part 2: Fake Websites Used to Deploy Chrome & Windows 0-Day Exploits
• Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO
• Fake LastPass Authenticator Installer Abuses Microsoft-Signed Driver to Kill Antivirus and EDR

Threat Intel & Breaches 7Vulns & Exploits 12Offensive Research 4Defense & AppSec 1AI Security 12Governance, Risk & Compliance 1Business & Boardroom 5

• An undercover Google analyst infiltrated a notorious supply-chain hacking gang
• 2026-09-15: SmartApeSG ClickFix to unidentified RAT to MeshAgent
• TanStack Supply Chain Attack Lets Hackers Steal 170 Private CrowdSec GitHub Repositories

Threat Intel & Breaches 9Vulns & Exploits 12Offensive Research 1AI Security 12Governance, Risk & Compliance 5Business & Boardroom 4

• FBI, Coast Guard boarded hacked oil tankers heading toward US coast
• Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer
• North Korea's fake job interviews infected 30,000 devices

Threat Intel & Breaches 13Vulns & Exploits 12Offensive Research 2Defense & AppSec 5AI Security 12Governance, Risk & Compliance 8Business & Boardroom 8

• Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties
• Beware the SparroWock: The backdoor that bites, the commands that catch
• Attacker infrastructure, but vibe-coded: tracking the evolution of credential harvesting platforms

Threat Intel & Breaches 12Vulns & Exploits 12Offensive Research 4Defense & AppSec 4AI Security 12Governance, Risk & Compliance 7Business & Boardroom 9

• Cyberattacks on Two Oil Tankers Prompt Coast Guard, FBI to Board Vessels
• The Odyssey and trojans again: MovieReaper attacks users in multiple countries via compromised torrents
• HEAVYGRAM: A Telegram-based Surveillance Backdoor Linked to Handala Hack

Threat Intel & Breaches 12Vulns & Exploits 12Offensive Research 2Defense & AppSec 10DFIR 1AI Security 12Governance, Risk & Compliance 8Business & Boardroom 11

• Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH
• One Exploit Chain, Two Espionage Campaigns: Chrome and Windows Under Fire
• NightEagle targets Russian companies

Threat Intel & Breaches 10Vulns & Exploits 12Offensive Research 1Defense & AppSec 5DFIR 1AI Security 12Governance, Risk & Compliance 2Business & Boardroom 7

• The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions
• Iranian cyber targeting of dissidents, activists and journalists
• 'Sandworm' Chains Cisco Vulnerabilities to Deploy Cyclops Blink

Threat Intel & Breaches 12Vulns & Exploits 12Offensive Research 3Defense & AppSec 5DFIR 1AI Security 9Governance, Risk & Compliance 2Business & Boardroom 7

• Smish. Click. Drained: Inside the Smishing Triad’s Phishing Cockpit
• Scammers target hundreds of thousands of crypto owners after Trezor confirms data breach of email provider
• CVE-2026-85706: Critical GitLab Path Traversal Exploited in the Wild

Threat Intel & Breaches 4Vulns & Exploits 12Defense & AppSec 2AI Security 12Governance, Risk & Compliance 5Business & Boardroom 11

• Hackers exploit Tencent app flaw to deploy GrayRabbit malware
• GitLab CVE-2026-85706: One HTTP Request, No Authentication, Full File Read – Exploited Within 24 Hours
• Artifactory flaws chained in attacks deploying backdoor malware

Threat Intel & Breaches 10Vulns & Exploits 12Defense & AppSec 3DFIR 1AI Security 12Governance, Risk & Compliance 7Business & Boardroom 8

• BlueMoon Exploit Kit Chains Recent Chrome, Windows Zero-Days
• “Eye” spy: Cyclops Blink returns with extended capabilities
• Hackers abused Claude to extract secrets from 1.8M Android apps

Threat Intel & Breaches 11Vulns & Exploits 12Offensive Research 5Defense & AppSec 4AI Security 12Governance, Risk & Compliance 7Business & Boardroom 9

• Hundreds of AI agents helped PaperCut attacker hit 395+ orgs, and some went off script
• Attackers are weaponizing the gap between Chromium fixes and Chrome patches
• Machine speed, hold the AI: Hand-rolled marimo CVE-2026-39987 exploit

Threat Intel & Breaches 12Vulns & Exploits 12Offensive Research 3Defense & AppSec 4DFIR 1AI Security 12Governance, Risk & Compliance 9Business & Boardroom 9

• Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329
• Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week
• SloppyRAT: A New Tool For Ransomware Attacks

Threat Intel & Breaches 11Vulns & Exploits 12Offensive Research 2Defense & AppSec 7DFIR 1AI Security 12Governance, Risk & Compliance 7Business & Boardroom 11

• Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & Windows
• Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF
• Active exploitation of Cisco Secure Firewall Management Center vulnerabilities

Threat Intel & Breaches 13Vulns & Exploits 12Offensive Research 4Defense & AppSec 4DFIR 1AI Security 12Governance, Risk & Compliance 7Business & Boardroom 13

• ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager
• Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit
• ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2

Threat Intel & Breaches 12Vulns & Exploits 12Offensive Research 2Defense & AppSec 4AI Security 12Governance, Risk & Compliance 5Business & Boardroom 12

• Dissecting a PHP web server rootkit
• Shai-Hulud Rises From the Dead after 111 days
• Online Maths Learning Platform Mathspace Disclosed Data Breach Impacts 1 Million Users

Threat Intel & Breaches 8Vulns & Exploits 12Defense & AppSec 2AI Security 12Governance, Risk & Compliance 5Business & Boardroom 7

• Coder's registry infrastructure compromised to push malicious modules
• FBI probes suspected breach at IDScan.net after dark web service Nexus offered 153M+ US and Canadian driver’s license scans
• Attackers conceal phishing lures using invisible Unicode characters

Threat Intel & Breaches 5Vulns & Exploits 12Offensive Research 1Defense & AppSec 3AI Security 12Governance, Risk & Compliance 3Business & Boardroom 9

• Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials
• Rhysida in Germany - From an Early Ransomware Payload to the 2026 Stuttgart and Berlin Threat…
• Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores

Threat Intel & Breaches 7Vulns & Exploits 12Offensive Research 1Defense & AppSec 2DFIR 1AI Security 12Governance, Risk & Compliance 5Business & Boardroom 6

• DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors
• Angry Birds: Toy Ghouls’ new toys
• Large group of Serbian opposition, activist figures targeted with spyware

Threat Intel & Breaches 11Vulns & Exploits 12Offensive Research 1Defense & AppSec 5DFIR 2AI Security 11Governance, Risk & Compliance 4Business & Boardroom 8

• It sure looks like hackers breached a major ID card verification service
• Impersonating IT support: how threat actors turn a remote session into enterprise-wide access
• Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America

Threat Intel & Breaches 12Vulns & Exploits 12Defense & AppSec 5DFIR 1AI Security 13Governance, Risk & Compliance 9Business & Boardroom 12

• BGP hijack infecting networks caused by a comedy of errors that’s not funny at all
• Peer Pressure: Inside the Sality Botnet Disruption Operation
• Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon

Threat Intel & Breaches 12Vulns & Exploits 12Offensive Research 2Defense & AppSec 7AI Security 12Governance, Risk & Compliance 6Business & Boardroom 12

• FBI Probes Service Selling 153M+ Drivers Licenses
• The Crypto Wallet That Never Opened: Tampered Exodus Installer Hides a Modular RAT
• Hackers push malicious Virtualizor update in BGP hijacking attack

Threat Intel & Breaches 12Vulns & Exploits 12Offensive Research 2Defense & AppSec 4DFIR 3AI Security 12Governance, Risk & Compliance 2Business & Boardroom 13

• Popular code generator for TanStack Query hit by supply chain worm
• CISA confirms hackers targeted over 100 US water systems during July
• Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode

Threat Intel & Breaches 12Vulns & Exploits 12Offensive Research 2Defense & AppSec 8DFIR 1AI Security 11Governance, Risk & Compliance 5Business & Boardroom 9

• FBI Disrupts Chinese Proxy Tools Used in Mass Hacking of US Agencies and Infrastructure
• New SLEEPWALKER Backdoor Waits for One Crafted Packet, Then Runs Its Own Bytecode
• FBI Disrupts China-Linked QTFY Infrastructure Used to Steal Data From U.S. Organizations

Threat Intel & Breaches 5Vulns & Exploits 12Offensive Research 1Defense & AppSec 5AI Security 12Governance, Risk & Compliance 5Business & Boardroom 9

• TerminalFix campaign deploys a reverse tunnel through multistage intrusion
• Mini Shai-Hulud worm hits openapi-react-query-codegen, spreads across npm, RubyGems, and PyPI | Blog | Endor Labs
• Australian police arrest two over TeamPCP hacks targeting Mercor, OpenAI, and others

Threat Intel & Breaches 12Vulns & Exploits 12Offensive Research 1Defense & AppSec 6DFIR 3AI Security 12Governance, Risk & Compliance 5Business & Boardroom 10

• @7nohe/openapi-react-query-codegen Compromised Through an Exposed npm Publishing Workflow
• China-Made ZBT Routers Ship With Two Implants Giving Unauthenticated Attackers Root Access
• BlueDelta Targets Defense and Diplomacy with HOOKEDGE

Threat Intel & Breaches 2Vulns & Exploits 12Offensive Research 1AI Security 4Business & Boardroom 4

• CISA Adds Six Exploited Flaws to KEV, Including NetScaler, Linux, and SQL Server Bugs
• CVE-2026-76835 (CVSS 9.3): OAuth2 Proxy honours a client-supplied X-Forwarded-Uri header when deciding whether a request may skip authentication, because the guard added for CVE
• CVE-2026-71921 (CVSS 9.3): Multiple DrayTek VigorSwitch models contain a pre-authentication command injection vulnerability in the setget.cgi interface. The vulnerability is cau

Threat Intel & Breaches 6Vulns & Exploits 12Offensive Research 3Defense & AppSec 4AI Security 11Governance, Risk & Compliance 5Business & Boardroom 5

• Edge infrastructure under siege: what two independent datasets reveal about who's exploiting your perimeter
• Tortoiseshell: New Toolset and Operational Infrastructure Exposed
• A GUID is Not a Credential: Unauthenticated RCE in Veeam Service Provider Console

Threat Intel & Breaches 2Vulns & Exploits 12Offensive Research 1Defense & AppSec 5DFIR 2AI Security 12Governance, Risk & Compliance 3Business & Boardroom 5

• Balonx Sistema: El Rostro Detrás del PhaaS que Impacta la Banca Mexicana
• Actively Exploited Oracle WebLogic Flaw Lets Unauthenticated Attackers Access Critical Data
• CVE-2026-60004: Gitea Gitea, Gitea Code Injection Vulnerability

Threat Intel & Breaches 11Vulns & Exploits 12Offensive Research 1Defense & AppSec 5DFIR 2AI Security 9Governance, Risk & Compliance 5Business & Boardroom 5

• UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit
• Hackers infect Android car head units with proxy botnet malware
• Iranian Cyberattacks Against Critical Infrastructure

Threat Intel & Breaches 5Vulns & Exploits 12Offensive Research 1Defense & AppSec 3DFIR 2AI Security 12Governance, Risk & Compliance 1Business & Boardroom 3

• CVE-2026-77649 (CVSS 9.8): The internment crate 0.8.7 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue depen
• CVE-2026-77806 (CVSS 9.8): SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code
• Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution

Threat Intel & Breaches 2Vulns & Exploits 12Defense & AppSec 2AI Security 5Governance, Risk & Compliance 5Business & Boardroom 4

• Critical Microsoft Entra ID vulnerability exploited in the wild (CVE-2026-69836)
• CVE-2026-72529 (CVSS 9.3): A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, a
• CVE-2026-72530 (CVSS 9.5): A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, a

Threat Intel & Breaches 7Vulns & Exploits 12Defense & AppSec 6DFIR 1AI Security 12Governance, Risk & Compliance 4Business & Boardroom 8

• Cl0p Targets 40+ Organizations Through PTC Windchill Flaw
• The invisible passenger in your car
• 2026-08-21: SmartApeSG ClickFix campaign leads to two RATs

Threat Intel & Breaches 11Vulns & Exploits 12Offensive Research 2Defense & AppSec 6DFIR 1AI Security 7Governance, Risk & Compliance 2Business & Boardroom 3

• Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns
• UAT-10147 deploys SPECTRE: A cross-platform implant with Linux rootkit and BYOVD capabilities
• AI-backed campaign targeting vulnerable Siemens S7 devices, CISA and FBI warn

Threat Intel & Breaches 8Vulns & Exploits 12Offensive Research 2Defense & AppSec 6DFIR 3AI Security 11Governance, Risk & Compliance 6Business & Boardroom 6

• Cl0p Hackers Exploit PTC Windchill Flaw to Steal Passwords and Sensitive Company Data
• NSA, FBI warns of hackers using AI-generated tools in attacks on critical infrastructure technology
• A New Era of Bulletproof Hosting Providers Emerge

Threat Intel & Breaches 10Vulns & Exploits 12Defense & AppSec 4DFIR 2AI Security 12Governance, Risk & Compliance 4Business & Boardroom 5

• Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect
• PurpleDelta's Fraudulent Employment Operations
• Hunting MacSync Stealer infrastructure through behavioral pivots

Threat Intel & Breaches 3Vulns & Exploits 12Offensive Research 2Defense & AppSec 2DFIR 1AI Security 10Governance, Risk & Compliance 4Business & Boardroom 12

• Fortune 500 Companies Hit in Azure Data Theft Campaign
• C2Looper: A New Backdoor Likely Tied To Ransomware With GitHub C2
• CVE-2025-62593: Ray-Project Ray, Ray-Project Ray Code Injection Vulnerability

Threat Intel & Breaches 2Vulns & Exploits 12Offensive Research 1DFIR 1AI Security 3Governance, Risk & Compliance 1Business & Boardroom 3

• CVE-2024-58374 (CVSS 8.7): Hongjing e-HR contains an unauthenticated SQL injection vulnerability in the getSdutyTree servlet endpoint that allows remote unauthenticated attacker
• CVE-2026-73532 (CVSS 9.3): Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update
• CVE-2026-67614 (CVSS 9.3): CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal FastAPI SSH service that allows unauthenticated remote attac

Threat Intel & Breaches 3Vulns & Exploits 12DFIR 1AI Security 12Governance, Risk & Compliance 4Business & Boardroom 5

• CVE-2026-49819 (CVSS 9.8): UpSnap is a wake on lan web app. Versions 4.4.1 through 5.3.5 are vulnerable to a missing-authentication / privilege-escalation chain in `pb.HandlerIn
• CVE-2026-73501 (CVSS 9.1): kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently re
• CVE-2026-13622 (CVSS 8.8): A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside

Threat Intel & Breaches 6Vulns & Exploits 12Offensive Research 1Defense & AppSec 7DFIR 1AI Security 12Governance, Risk & Compliance 6Business & Boardroom 3

• APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit
• Russia Targets Businesses and Officials Behind Europe’s Ukraine Defense Supply Chain
• You’re Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?))

Threat Intel & Breaches 12Vulns & Exploits 12Offensive Research 1Defense & AppSec 6DFIR 2AI Security 12Governance, Risk & Compliance 3Business & Boardroom 6

• Armored Likho expands its cyber-espionage toolkit
• Multi-Functional Linux Botnet “Evooo1Bot”
• Dissecting the JWR phishing framework

Threat Intel & Breaches 12Vulns & Exploits 12Defense & AppSec 7DFIR 1AI Security 9Governance, Risk & Compliance 1Business & Boardroom 12

• Terabytes of credentials leaked in massive supply-chain attack
• ClickFix campaign abuses Deno runtime for infostealer delivery
• Sandworm hackers target IT pros with trojanized WireGuard VPN client

Threat Intel & Breaches 12Vulns & Exploits 12Offensive Research 2Defense & AppSec 8DFIR 1AI Security 12Governance, Risk & Compliance 5Business & Boardroom 6

• Shattering the Dream – When a Job Offer Becomes a Zero-Day Attack
• Hackers Breach Polish Power Plant Controls via Private Cellular Network and Shut Turbine
• Head Mare APT is exploiting vulnerabilities in an unpatched TrueConf server to deliver PhantomCore and PhantomGraph to video conference participants

Threat Intel & Breaches 12Vulns & Exploits 12Offensive Research 2Defense & AppSec 10DFIR 1AI Security 12Governance, Risk & Compliance 3Business & Boardroom 9

• #StopRansomware: Gunra Ransomware
• Abyssos: Technical Analysis of a New Modular RAT
• China-linked hackers turning popular cybersecurity tool into ransomware launchpad, Microsoft warns

Threat Intel & Breaches 6Vulns & Exploits 12Offensive Research 2Defense & AppSec 4DFIR 3AI Security 12Governance, Risk & Compliance 1Business & Boardroom 5

• CVE-2026-11976 (CVSS 10.0): The official MonsterInsights Pro update distribution bucket (`monster-insights.s3.amazonaws.com`) was compromised. Both the current release (10.2.2) a
• CVE-2026-17032 (CVSS 9.8): Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers
• Attackers Exploit N-able Patch Bypass Flaw on RMM Servers

Threat Intel & Breaches 12Vulns & Exploits 12Offensive Research 5Defense & AppSec 12DFIR 5AI Security 12Governance, Risk & Compliance 12Business & Boardroom 12

• ChainDrop supply chain compromise: Anatomy of a self-propagating worm
• Hackers breach TrueConf to trojanize client installers with backdoors
• Phoenix Rising: Exposing the PhaaS Kit Behind Global Mass Phishing Campaigns

Threat Intel & Breaches 12Vulns & Exploits 12Offensive Research 4Defense & AppSec 12AI Security 12

• Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages
• CVE-2026-66747 (CVSS 9.3), Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the op
• ChainDrop: Inside a Self-Propagating npm Worm