Every edition

Threat Intel & Breaches 1Vulns & Exploits 12Defense & AppSec 1DFIR 1Governance, Risk & Compliance 2Business & Boardroom 1

• Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot
• Hackers pull off $133 million French bank heist via service provider

Threat Intel & Breaches 4Vulns & Exploits 12Defense & AppSec 4DFIR 1AI Security 12Governance, Risk & Compliance 3Business & Boardroom 10

• From Streaming to Stealing: Mirax and the Rise of Server-side Android Device Takeover in META
• CVE-2026-102895 (CVSS 9.8): GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0, get_current_user in gpustack/api/au
• SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins

Threat Intel & Breaches 9Vulns & Exploits 15Offensive Research 3Defense & AppSec 11AI Security 8Governance, Risk & Compliance 4Business & Boardroom 10

• CERT-In flags an AI threat actor targeting BFSI payment APIs for unauthorized fund transfers
• Storm-2603 Hackers Exploit SharePoint ToolShell Flaws to Hide Fileless Backdoor and Launch Ransomware Attack
• Turning Up the Heat: Inside the Attacks on Europe’s Refrigeration System

Threat Intel & Breaches 17Vulns & Exploits 13Offensive Research 1Defense & AppSec 3DFIR 4AI Security 10Governance, Risk & Compliance 3Business & Boardroom 8

• Binance says hackers who stole billions in crypto spent months planning heist
• Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns
• The SOC Files 5: Ghost in the pipeline, or a fileless SharePoint breach by Storm-2603

Threat Intel & Breaches 13Vulns & Exploits 13Offensive Research 2Defense & AppSec 1AI Security 12Governance, Risk & Compliance 4Business & Boardroom 12

• North Korean fake job interview led to $6.3B Binance heist
• Poisoned cPGuard update hits thousands of web hosting servers
• Gorbag: Orcs at the border harvesting intelligence from Ukraine

Threat Intel & Breaches 12Vulns & Exploits 12Offensive Research 1Defense & AppSec 1AI Security 12Governance, Risk & Compliance 3Business & Boardroom 9

• Binance CEO says ‘months-long campaign’ led to $6.3 billion theft as N. Korea denies responsibility
• antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer
• European refrigerator controller redux: A new wave of refrigeration attacks

Threat Intel & Breaches 11Vulns & Exploits 12Defense & AppSec 8DFIR 1AI Security 13Governance, Risk & Compliance 4Business & Boardroom 14

• Shutting the Door on the XCPE Botnet
• Synology warns of C3RB3R ransomware attacks targeting NAS devices
• Agentic pen-testing tool employed in multiple espionage campaigns around the globe

Threat Intel & Breaches 7Vulns & Exploits 12Offensive Research 2Defense & AppSec 3DFIR 3AI Security 7Governance, Risk & Compliance 5Business & Boardroom 15

• India's RBI tightens cyber checks on lenders after spate of hacks
• Malicious Claude Code extension on Cursor planted SSH backdoors
• Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers

Threat Intel & Breaches 8Vulns & Exploits 12Offensive Research 2Defense & AppSec 7AI Security 12Governance, Risk & Compliance 4Business & Boardroom 13

• Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer
• Inside a malicious Claude Code-branded extension and its persistent SSH backdoor
• Chinese Actor Compromises US Government Network Via Chained PHP2Shell Exploit

Threat Intel & Breaches 9Vulns & Exploits 12Offensive Research 2Defense & AppSec 7DFIR 2AI Security 12Governance, Risk & Compliance 5Business & Boardroom 16

• Backdoor in Claude Code for VS Code extension on the Cursor Marketplace
• AI used in Aur0ra ransomware testing and execution
• CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV

Threat Intel & Breaches 13Vulns & Exploits 12Defense & AppSec 2DFIR 1AI Security 12Governance, Risk & Compliance 5Business & Boardroom 8

• VAPOR PANDA Uses AI-Driven ARTEX to Scale a Global Espionage Campaign
• Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware
• NIK C2: The new AI-enabled command-and-control framework

Threat Intel & Breaches 14Vulns & Exploits 12Defense & AppSec 3AI Security 12Governance, Risk & Compliance 6Business & Boardroom 12

• False Protection, Emptied Accounts: The Seven Android Trojan Families Targeting Indian Banking Apps
• Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN
• Attackers compromised 42 GitHub repositories by using files too large to be searched

Threat Intel & Breaches 7Vulns & Exploits 12Offensive Research 3Defense & AppSec 5AI Security 13Governance, Risk & Compliance 5Business & Boardroom 11

• Tricks from the Past deployed via signed ChatGPT and Claude binaries
• Former pentester used ARTEX AI to steal 8.2 million data records
• CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution

Threat Intel & Breaches 13Vulns & Exploits 12Offensive Research 2Defense & AppSec 8DFIR 1AI Security 12Governance, Risk & Compliance 4Business & Boardroom 12

• 333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email
• Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline
• testmetest npm Packages Carry a Miasma-Family Worm

Threat Intel & Breaches 3Vulns & Exploits 12Offensive Research 1Defense & AppSec 1AI Security 12Governance, Risk & Compliance 2Business & Boardroom 9

• PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking
• Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles
• Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability

Threat Intel & Breaches 7Vulns & Exploits 12Offensive Research 1Defense & AppSec 5DFIR 1AI Security 7Governance, Risk & Compliance 6Business & Boardroom 10

• litellm 1.107.0 Compromised on PyPI: Backdoored Wheels Drop a Credential Stealer and an Hourly Remote Code Loader
• OVHcloud CLI Compromised via GitHub Release Swap: Detonating the Real GlassWorm Loader and What We Found
• Microsoft: Chinese State Actor Used AI to Compromise ConnectWise Tenants

Threat Intel & Breaches 9Vulns & Exploits 12Offensive Research 1Defense & AppSec 2DFIR 1AI Security 13Governance, Risk & Compliance 7Business & Boardroom 11

• Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks
• MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration
• M365 Token Spray and Replay Campaign Compromises Business Email Accounts

Threat Intel & Breaches 12Vulns & Exploits 12Offensive Research 3Defense & AppSec 2DFIR 1AI Security 13Governance, Risk & Compliance 4Business & Boardroom 8

• RBI asks banks, payment firms to forensically clear tech environments in case of a data breach
• AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
• LiteLLM attacked again: Malicious 1.107.0 wheels on PyPI and Docker Hub (October 2026)

Threat Intel & Breaches 12Vulns & Exploits 12Offensive Research 2Defense & AppSec 6AI Security 13Governance, Risk & Compliance 4Business & Boardroom 13

• Compromised eMudhra intermediate certificates
• LiteLLM Compromised, Steals Credentials
• Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware

Threat Intel & Breaches 12Vulns & Exploits 12Offensive Research 4Defense & AppSec 11DFIR 2AI Security 12Governance, Risk & Compliance 6Business & Boardroom 10

• Governments are hacking people with ‘zero-click’ spyware by showing them online ads
• Hackers Exploit Palo Alto VPN Flaw to Bypass MFA and Steal Credentials From VMware Disks
• Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware

Threat Intel & Breaches 12Vulns & Exploits 12Offensive Research 1Defense & AppSec 7DFIR 4AI Security 12Governance, Risk & Compliance 3Business & Boardroom 13

• Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19)
• CVE-2025-8088: Silent Lynx attacks governments via WinRAR
• ConnectWise suspends Cloud Backup service after supply chain attack

Threat Intel & Breaches 3Vulns & Exploits 12Offensive Research 4Defense & AppSec 2AI Security 10Governance, Risk & Compliance 2Business & Boardroom 9

• ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants
• CVE-2026-57155 (CVSS 9.9): OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's process_zip() and process_gzi
• Hackers exploit SiteGuard WAF flaw to run commands as SYSTEM, root

Threat Intel & Breaches 8Vulns & Exploits 12Offensive Research 2Defense & AppSec 5AI Security 11Governance, Risk & Compliance 1Business & Boardroom 7

• Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack
• Targeted ads installed Candiru spyware in zero-click attacks
• CVE-2026-59774 (CVSS 9.8): Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side file

Threat Intel & Breaches 12Vulns & Exploits 12Offensive Research 3Defense & AppSec 5AI Security 14Governance, Risk & Compliance 3Business & Boardroom 3

• CERT-In Warns AI Agents Accessed Sensitive Data at Indian Organizations During Testing
• Investigating Ephemeral Supply Chain Tampering
• Hackers Use Codex and DeepSeek AI Agents to Breach 440 PaperCut Servers Worldwide

Threat Intel & Breaches 12Vulns & Exploits 12Offensive Research 4Defense & AppSec 4AI Security 12Governance, Risk & Compliance 5Business & Boardroom 6

• ARMORY CASTLE Exploits BeyondTrust
• ‘Nightmare Scenario’: Zero-Click Spyware Is Infecting Phones via Targeted Ads
• UAT-6275 Hackers Exploit WinRAR Flaw to Target CIS Government Organizations

Threat Intel & Breaches 12Vulns & Exploits 12Offensive Research 6Defense & AppSec 12DFIR 4AI Security 12Governance, Risk & Compliance 6Business & Boardroom 10

• Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant
• Hackers heat up supermarket fridges, spoiling food across France
• Justice Department says North Koreans have infiltrated dozens of U.S. companies

Threat Intel & Breaches 8Vulns & Exploits 12Offensive Research 2Defense & AppSec 7DFIR 2AI Security 12Governance, Risk & Compliance 2Business & Boardroom 10

• A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days
• Ledger confirms spy chip implant behind wallet crypto thefts
• Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies

Threat Intel & Breaches 7Vulns & Exploits 12Offensive Research 3Defense & AppSec 9DFIR 2AI Security 12Governance, Risk & Compliance 8Business & Boardroom 12

• Auditing the auditor: Unmasking Apex Accelerator
• Zod 4.6.6 compromised by malware?
• Luna Moth Leaks Shed Light on Ransomware Group's Inner Workings

Threat Intel & Breaches 10Vulns & Exploits 12Offensive Research 2Defense & AppSec 4AI Security 7Governance, Risk & Compliance 2Business & Boardroom 12

• AI-Driven tool ARTEX used in attacks against South Korean Banks
• FBI and Secret Service Warn of FortiBleed Lockout Threat
• US announces effort to disrupt hacking infrastructure run by China's Integrity Tech Group

Threat Intel & Breaches 10Vulns & Exploits 12Offensive Research 5Defense & AppSec 7DFIR 1AI Security 10Governance, Risk & Compliance 9Business & Boardroom 12

• P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands
• UK and Allies Warn of Cyber Threat from China’s Integrity Technology Group
• Unpatched AhsayCBS flaws exploited to deploy webshells, mine crypto

Threat Intel & Breaches 10Vulns & Exploits 12Offensive Research 6Defense & AppSec 4DFIR 1AI Security 13Governance, Risk & Compliance 4Business & Boardroom 12

• Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer
• GhostAction Returns: Malicious “Security Audit” Workflows Now Mine Credentials from Entire Git Histories
• MATCHBOIL: New tricks, same old evil intentions

Threat Intel & Breaches 12Vulns & Exploits 12Offensive Research 3Defense & AppSec 10DFIR 2AI Security 12Governance, Risk & Compliance 8Business & Boardroom 13

• Tensorlake npm Package Compromised: A Worm With a Hostage Token That Wipes Your Machine If You Revoke It
• FBI: FortiBleed attackers can lock organizations out of their own firewalls
• US disrupts Chinese hacking tools as 7 govts warn of PRC spies stealing sensitive data worldwide

Threat Intel & Breaches 12Vulns & Exploits 12Defense & AppSec 12DFIR 1AI Security 12Governance, Risk & Compliance 12Business & Boardroom 12

• FortiBleed still a bleeding nuisance as FBI confirms ongoing attacks
• DarkSword/Coruna Open Directory Finding Report
• Attackers hijacked top-level domains, minted fake security certs for Google and other orgs

Threat Intel & Breaches 12Vulns & Exploits 12Offensive Research 3Defense & AppSec 12DFIR 1AI Security 12Governance, Risk & Compliance 6Business & Boardroom 12

• Hackers obtain counterfeit TLS certificates for Google and other large services
• Midnight Blizzard Abuses Hotel Wi-Fi Captive Portals to Deliver Malware and Steal Credentials
• Alert: FortiBleed remains active campaign, can lock out users or lead to ransomware attacks

Threat Intel & Breaches 10Vulns & Exploits 12Offensive Research 1Defense & AppSec 12DFIR 1AI Security 9Governance, Risk & Compliance 4Business & Boardroom 13

• 2026-10-02: Atomic macOS (AMOS) Stealer infection from malicious ad impersonating Claude Code
• FBI confirms 'multiple' arrests related to ShinyHunters hack
• US, Australia warn of latest Citrix vulnerability after NetScaler advisory

Threat Intel & Breaches 12Vulns & Exploits 12Offensive Research 4Defense & AppSec 3DFIR 1AI Security 12Governance, Risk & Compliance 5Business & Boardroom 13

• WordPress Backdoor Rebuilds Itself After Cleanup Using Files, Database, and Shared Memory
• China-Aligned TA419 Targets U.S. AI Policy Experts With Microsoft AitM Phishing
• CVE-2026-88779: Citrix NetScaler, Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

Threat Intel & Breaches 12Vulns & Exploits 12Offensive Research 3Defense & AppSec 11DFIR 1AI Security 12Governance, Risk & Compliance 11Business & Boardroom 12

• Hackers Breached Propulsion System of US-Bound Oil Tanker
• Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware
• 2026-09-29: Macfinger ClickFix activity

Threat Intel & Breaches 9Vulns & Exploits 12Offensive Research 3Defense & AppSec 8DFIR 1AI Security 12Governance, Risk & Compliance 6Business & Boardroom 11

• AI agents hacked the hackers, stealing email addresses from security research org
• SMTP is the key: BPFDoor and AVERAT hitting the network edge
• Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes

Threat Intel & Breaches 12Vulns & Exploits 12Offensive Research 7Defense & AppSec 12DFIR 3AI Security 12Governance, Risk & Compliance 7Business & Boardroom 12

• Warlock Ransomware Exploiting SharePoint Flaws to Attack Water and Telecom Operators
• Microsoft catches hackers exploiting Zimbra bug before disclosure
• Determined Attacker Uploads Malicious Webshells to Parks and Rec Management Platform Servers

Threat Intel & Breaches 12Vulns & Exploits 12Offensive Research 2Defense & AppSec 11DFIR 2AI Security 12Governance, Risk & Compliance 12Business & Boardroom 12

• Star Blizzard refines phishing and malware delivery with the RedFlick technique
• China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor
• SilverFox: Tracking the Distribution of a Domestic Variant of a Malicious Installation File Posing as KakaoTalk

Threat Intel & Breaches 12Vulns & Exploits 12Offensive Research 2Defense & AppSec 3DFIR 2AI Security 12Governance, Risk & Compliance 5Business & Boardroom 6

• DirtyBlanket: Fake Express Packages on npm Spread a Linux Worm
• FBI Hackers Say They Won’t Publish Massive Trove of FBI Employee Data
• Phishing Abuses RMM Tools for Persistent Access

Threat Intel & Breaches 6Vulns & Exploits 12Offensive Research 2Defense & AppSec 5DFIR 1AI Security 12Governance, Risk & Compliance 3Business & Boardroom 12

• NeedyMantis: Unpacking a post-compromise malware family used in targeted operations
• Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild
• AgentXploit: Autonomous Repository-to-Runtime Red-Teaming for AI Agents

Threat Intel & Breaches 10Vulns & Exploits 13Offensive Research 1Defense & AppSec 4DFIR 1AI Security 12Governance, Risk & Compliance 3Business & Boardroom 7

• ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft
• North Korean hackers suspected in $351M crypto theft, the largest so far this year
• Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway

Threat Intel & Breaches 7Vulns & Exploits 12Offensive Research 1Defense & AppSec 5AI Security 11Governance, Risk & Compliance 4Business & Boardroom 7

• Kothamine malware uses Tailscale’s tailcat to evade network detection
• ShinyHunters hacked Clop leak site using Grav CMS path traversal flaw
• SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild

Threat Intel & Breaches 11Vulns & Exploits 12Offensive Research 2Defense & AppSec 6DFIR 1AI Security 12Governance, Risk & Compliance 7Business & Boardroom 4

• Storm-3168: Agentic-driven cloud attacks using compromised service principals
• A Closer Look at Malware From the Macfinger ClickFix Campaign, (Fri, Sep 25th)
• Crypto CEO accuses North Korea of stealing $387 million from Bitget platform

Threat Intel & Breaches 11Vulns & Exploits 12Offensive Research 3Defense & AppSec 7DFIR 4AI Security 12Governance, Risk & Compliance 3Business & Boardroom 8

• Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments
• MacSync under the microscope: new delivery methods and a new payload
• Placeholder domain used in dev docs now serves ClickFix attacks

Threat Intel & Breaches 12Vulns & Exploits 12Offensive Research 7Defense & AppSec 8DFIR 1AI Security 12Governance, Risk & Compliance 6Business & Boardroom 6

• MemTensor npm and PyPI Packages Hit by a Go Worm
• Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware
• Macfinger ClickFix campaign, (Tue, Sep 22nd)

Threat Intel & Breaches 13Vulns & Exploits 12Offensive Research 7Defense & AppSec 7DFIR 2AI Security 12Governance, Risk & Compliance 9Business & Boardroom 10

• Attacker compromised nearly 1000 Zyxel switches since August (CVE-2026-7273)
• Unmasking EvilTokens: Getting to the root of device code phishing
• Hackers Exploit WordPress Flaws to Steal 18,566 Government Records and Plaintext Passwords

Threat Intel & Breaches 13Vulns & Exploits 12Offensive Research 4Defense & AppSec 8DFIR 2AI Security 12Governance, Risk & Compliance 3Business & Boardroom 10

• Mind the (Patch) Gap, Part 2: Fake Websites Used to Deploy Chrome & Windows 0-Day Exploits
• Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO
• Fake LastPass Authenticator Installer Abuses Microsoft-Signed Driver to Kill Antivirus and EDR

Threat Intel & Breaches 7Vulns & Exploits 12Offensive Research 4Defense & AppSec 1AI Security 12Governance, Risk & Compliance 1Business & Boardroom 5

• An undercover Google analyst infiltrated a notorious supply-chain hacking gang
• 2026-09-15: SmartApeSG ClickFix to unidentified RAT to MeshAgent
• TanStack Supply Chain Attack Lets Hackers Steal 170 Private CrowdSec GitHub Repositories

Threat Intel & Breaches 9Vulns & Exploits 12Offensive Research 1AI Security 12Governance, Risk & Compliance 5Business & Boardroom 4

• FBI, Coast Guard boarded hacked oil tankers heading toward US coast
• Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer
• North Korea's fake job interviews infected 30,000 devices

Threat Intel & Breaches 13Vulns & Exploits 12Offensive Research 2Defense & AppSec 5AI Security 12Governance, Risk & Compliance 8Business & Boardroom 8

• Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties
• Beware the SparroWock: The backdoor that bites, the commands that catch
• Attacker infrastructure, but vibe-coded: tracking the evolution of credential harvesting platforms

Threat Intel & Breaches 12Vulns & Exploits 12Offensive Research 4Defense & AppSec 4AI Security 12Governance, Risk & Compliance 7Business & Boardroom 9

• Cyberattacks on Two Oil Tankers Prompt Coast Guard, FBI to Board Vessels
• The Odyssey and trojans again: MovieReaper attacks users in multiple countries via compromised torrents
• HEAVYGRAM: A Telegram-based Surveillance Backdoor Linked to Handala Hack

Threat Intel & Breaches 12Vulns & Exploits 12Offensive Research 2Defense & AppSec 10DFIR 1AI Security 12Governance, Risk & Compliance 8Business & Boardroom 11

• Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH
• One Exploit Chain, Two Espionage Campaigns: Chrome and Windows Under Fire
• NightEagle targets Russian companies

Threat Intel & Breaches 10Vulns & Exploits 12Offensive Research 1Defense & AppSec 5DFIR 1AI Security 12Governance, Risk & Compliance 2Business & Boardroom 7

• The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions
• Iranian cyber targeting of dissidents, activists and journalists
• 'Sandworm' Chains Cisco Vulnerabilities to Deploy Cyclops Blink

Threat Intel & Breaches 12Vulns & Exploits 12Offensive Research 3Defense & AppSec 5DFIR 1AI Security 9Governance, Risk & Compliance 2Business & Boardroom 7

• Smish. Click. Drained: Inside the Smishing Triad’s Phishing Cockpit
• Scammers target hundreds of thousands of crypto owners after Trezor confirms data breach of email provider
• CVE-2026-85706: Critical GitLab Path Traversal Exploited in the Wild

Threat Intel & Breaches 4Vulns & Exploits 12Defense & AppSec 2AI Security 12Governance, Risk & Compliance 5Business & Boardroom 11

• Hackers exploit Tencent app flaw to deploy GrayRabbit malware
• GitLab CVE-2026-85706: One HTTP Request, No Authentication, Full File Read – Exploited Within 24 Hours
• Artifactory flaws chained in attacks deploying backdoor malware

Threat Intel & Breaches 10Vulns & Exploits 12Defense & AppSec 3DFIR 1AI Security 12Governance, Risk & Compliance 7Business & Boardroom 8

• BlueMoon Exploit Kit Chains Recent Chrome, Windows Zero-Days
• “Eye” spy: Cyclops Blink returns with extended capabilities
• Hackers abused Claude to extract secrets from 1.8M Android apps

Threat Intel & Breaches 11Vulns & Exploits 12Offensive Research 5Defense & AppSec 4AI Security 12Governance, Risk & Compliance 7Business & Boardroom 9

• Hundreds of AI agents helped PaperCut attacker hit 395+ orgs, and some went off script
• Attackers are weaponizing the gap between Chromium fixes and Chrome patches
• Machine speed, hold the AI: Hand-rolled marimo CVE-2026-39987 exploit

Threat Intel & Breaches 12Vulns & Exploits 12Offensive Research 3Defense & AppSec 4DFIR 1AI Security 12Governance, Risk & Compliance 9Business & Boardroom 9

• Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329
• Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week
• SloppyRAT: A New Tool For Ransomware Attacks

Threat Intel & Breaches 11Vulns & Exploits 12Offensive Research 2Defense & AppSec 7DFIR 1AI Security 12Governance, Risk & Compliance 7Business & Boardroom 11

• Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & Windows
• Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF
• Active exploitation of Cisco Secure Firewall Management Center vulnerabilities

Threat Intel & Breaches 13Vulns & Exploits 12Offensive Research 4Defense & AppSec 4DFIR 1AI Security 12Governance, Risk & Compliance 7Business & Boardroom 13

• ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager
• Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit
• ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2

Threat Intel & Breaches 12Vulns & Exploits 12Offensive Research 2Defense & AppSec 4AI Security 12Governance, Risk & Compliance 5Business & Boardroom 12

• Dissecting a PHP web server rootkit
• Shai-Hulud Rises From the Dead after 111 days
• Online Maths Learning Platform Mathspace Disclosed Data Breach Impacts 1 Million Users

Threat Intel & Breaches 8Vulns & Exploits 12Defense & AppSec 2AI Security 12Governance, Risk & Compliance 5Business & Boardroom 7

• Coder's registry infrastructure compromised to push malicious modules
• FBI probes suspected breach at IDScan.net after dark web service Nexus offered 153M+ US and Canadian driver’s license scans
• Attackers conceal phishing lures using invisible Unicode characters

Threat Intel & Breaches 5Vulns & Exploits 12Offensive Research 1Defense & AppSec 3AI Security 12Governance, Risk & Compliance 3Business & Boardroom 9

• Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials
• Rhysida in Germany - From an Early Ransomware Payload to the 2026 Stuttgart and Berlin Threat…
• Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores

Threat Intel & Breaches 7Vulns & Exploits 12Offensive Research 1Defense & AppSec 2DFIR 1AI Security 12Governance, Risk & Compliance 5Business & Boardroom 6

• DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors
• Angry Birds: Toy Ghouls’ new toys
• Large group of Serbian opposition, activist figures targeted with spyware

Threat Intel & Breaches 11Vulns & Exploits 12Offensive Research 1Defense & AppSec 5DFIR 2AI Security 11Governance, Risk & Compliance 4Business & Boardroom 8

• It sure looks like hackers breached a major ID card verification service
• Impersonating IT support: how threat actors turn a remote session into enterprise-wide access
• Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America

Threat Intel & Breaches 12Vulns & Exploits 12Defense & AppSec 5DFIR 1AI Security 13Governance, Risk & Compliance 9Business & Boardroom 12

• BGP hijack infecting networks caused by a comedy of errors that’s not funny at all
• Peer Pressure: Inside the Sality Botnet Disruption Operation
• Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon

Threat Intel & Breaches 12Vulns & Exploits 12Offensive Research 2Defense & AppSec 7AI Security 12Governance, Risk & Compliance 6Business & Boardroom 12

• FBI Probes Service Selling 153M+ Drivers Licenses
• The Crypto Wallet That Never Opened: Tampered Exodus Installer Hides a Modular RAT
• Hackers push malicious Virtualizor update in BGP hijacking attack

Threat Intel & Breaches 12Vulns & Exploits 12Offensive Research 2Defense & AppSec 4DFIR 3AI Security 12Governance, Risk & Compliance 2Business & Boardroom 13

• Popular code generator for TanStack Query hit by supply chain worm
• CISA confirms hackers targeted over 100 US water systems during July
• Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode

Threat Intel & Breaches 12Vulns & Exploits 12Offensive Research 2Defense & AppSec 8DFIR 1AI Security 11Governance, Risk & Compliance 5Business & Boardroom 9

• FBI Disrupts Chinese Proxy Tools Used in Mass Hacking of US Agencies and Infrastructure
• New SLEEPWALKER Backdoor Waits for One Crafted Packet, Then Runs Its Own Bytecode
• FBI Disrupts China-Linked QTFY Infrastructure Used to Steal Data From U.S. Organizations

Threat Intel & Breaches 5Vulns & Exploits 12Offensive Research 1Defense & AppSec 5AI Security 12Governance, Risk & Compliance 5Business & Boardroom 9

• TerminalFix campaign deploys a reverse tunnel through multistage intrusion
• Mini Shai-Hulud worm hits openapi-react-query-codegen, spreads across npm, RubyGems, and PyPI | Blog | Endor Labs
• Australian police arrest two over TeamPCP hacks targeting Mercor, OpenAI, and others

Threat Intel & Breaches 12Vulns & Exploits 12Offensive Research 1Defense & AppSec 6DFIR 3AI Security 12Governance, Risk & Compliance 5Business & Boardroom 10

• @7nohe/openapi-react-query-codegen Compromised Through an Exposed npm Publishing Workflow
• China-Made ZBT Routers Ship With Two Implants Giving Unauthenticated Attackers Root Access
• BlueDelta Targets Defense and Diplomacy with HOOKEDGE

Threat Intel & Breaches 2Vulns & Exploits 12Offensive Research 1AI Security 4Business & Boardroom 4

• CISA Adds Six Exploited Flaws to KEV, Including NetScaler, Linux, and SQL Server Bugs
• CVE-2026-76835 (CVSS 9.3): OAuth2 Proxy honours a client-supplied X-Forwarded-Uri header when deciding whether a request may skip authentication, because the guard added for CVE
• CVE-2026-71921 (CVSS 9.3): Multiple DrayTek VigorSwitch models contain a pre-authentication command injection vulnerability in the setget.cgi interface. The vulnerability is cau

Threat Intel & Breaches 6Vulns & Exploits 12Offensive Research 3Defense & AppSec 4AI Security 11Governance, Risk & Compliance 5Business & Boardroom 5

• Edge infrastructure under siege: what two independent datasets reveal about who's exploiting your perimeter
• Tortoiseshell: New Toolset and Operational Infrastructure Exposed
• A GUID is Not a Credential: Unauthenticated RCE in Veeam Service Provider Console

Threat Intel & Breaches 2Vulns & Exploits 12Offensive Research 1Defense & AppSec 5DFIR 2AI Security 12Governance, Risk & Compliance 3Business & Boardroom 5

• Balonx Sistema: El Rostro Detrás del PhaaS que Impacta la Banca Mexicana
• Actively Exploited Oracle WebLogic Flaw Lets Unauthenticated Attackers Access Critical Data
• CVE-2026-60004: Gitea Gitea, Gitea Code Injection Vulnerability

Threat Intel & Breaches 11Vulns & Exploits 12Offensive Research 1Defense & AppSec 5DFIR 2AI Security 9Governance, Risk & Compliance 5Business & Boardroom 5

• UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit
• Hackers infect Android car head units with proxy botnet malware
• Iranian Cyberattacks Against Critical Infrastructure

Threat Intel & Breaches 5Vulns & Exploits 12Offensive Research 1Defense & AppSec 3DFIR 2AI Security 12Governance, Risk & Compliance 1Business & Boardroom 3

• CVE-2026-77649 (CVSS 9.8): The internment crate 0.8.7 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue depen
• CVE-2026-77806 (CVSS 9.8): SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code
• Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution

Threat Intel & Breaches 2Vulns & Exploits 12Defense & AppSec 2AI Security 5Governance, Risk & Compliance 5Business & Boardroom 4

• Critical Microsoft Entra ID vulnerability exploited in the wild (CVE-2026-69836)
• CVE-2026-72529 (CVSS 9.3): A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, a
• CVE-2026-72530 (CVSS 9.5): A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, a

Threat Intel & Breaches 7Vulns & Exploits 12Defense & AppSec 6DFIR 1AI Security 12Governance, Risk & Compliance 4Business & Boardroom 8

• Cl0p Targets 40+ Organizations Through PTC Windchill Flaw
• The invisible passenger in your car
• 2026-08-21: SmartApeSG ClickFix campaign leads to two RATs

Threat Intel & Breaches 11Vulns & Exploits 12Offensive Research 2Defense & AppSec 6DFIR 1AI Security 7Governance, Risk & Compliance 2Business & Boardroom 3

• Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns
• UAT-10147 deploys SPECTRE: A cross-platform implant with Linux rootkit and BYOVD capabilities
• AI-backed campaign targeting vulnerable Siemens S7 devices, CISA and FBI warn

Threat Intel & Breaches 8Vulns & Exploits 12Offensive Research 2Defense & AppSec 6DFIR 3AI Security 11Governance, Risk & Compliance 6Business & Boardroom 6

• Cl0p Hackers Exploit PTC Windchill Flaw to Steal Passwords and Sensitive Company Data
• NSA, FBI warns of hackers using AI-generated tools in attacks on critical infrastructure technology
• A New Era of Bulletproof Hosting Providers Emerge

Threat Intel & Breaches 10Vulns & Exploits 12Defense & AppSec 4DFIR 2AI Security 12Governance, Risk & Compliance 4Business & Boardroom 5

• Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect
• PurpleDelta's Fraudulent Employment Operations
• Hunting MacSync Stealer infrastructure through behavioral pivots

Threat Intel & Breaches 3Vulns & Exploits 12Offensive Research 2Defense & AppSec 2DFIR 1AI Security 10Governance, Risk & Compliance 4Business & Boardroom 12

• Fortune 500 Companies Hit in Azure Data Theft Campaign
• C2Looper: A New Backdoor Likely Tied To Ransomware With GitHub C2
• CVE-2025-62593: Ray-Project Ray, Ray-Project Ray Code Injection Vulnerability

Threat Intel & Breaches 2Vulns & Exploits 12Offensive Research 1DFIR 1AI Security 3Governance, Risk & Compliance 1Business & Boardroom 3

• CVE-2024-58374 (CVSS 8.7): Hongjing e-HR contains an unauthenticated SQL injection vulnerability in the getSdutyTree servlet endpoint that allows remote unauthenticated attacker
• CVE-2026-73532 (CVSS 9.3): Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update
• CVE-2026-67614 (CVSS 9.3): CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal FastAPI SSH service that allows unauthenticated remote attac

Threat Intel & Breaches 3Vulns & Exploits 12DFIR 1AI Security 12Governance, Risk & Compliance 4Business & Boardroom 5

• CVE-2026-49819 (CVSS 9.8): UpSnap is a wake on lan web app. Versions 4.4.1 through 5.3.5 are vulnerable to a missing-authentication / privilege-escalation chain in `pb.HandlerIn
• CVE-2026-73501 (CVSS 9.1): kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently re
• CVE-2026-13622 (CVSS 8.8): A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside

Threat Intel & Breaches 6Vulns & Exploits 12Offensive Research 1Defense & AppSec 7DFIR 1AI Security 12Governance, Risk & Compliance 6Business & Boardroom 3

• APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit
• Russia Targets Businesses and Officials Behind Europe’s Ukraine Defense Supply Chain
• You’re Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?))

Threat Intel & Breaches 12Vulns & Exploits 12Offensive Research 1Defense & AppSec 6DFIR 2AI Security 12Governance, Risk & Compliance 3Business & Boardroom 6

• Armored Likho expands its cyber-espionage toolkit
• Multi-Functional Linux Botnet “Evooo1Bot”
• Dissecting the JWR phishing framework

Threat Intel & Breaches 12Vulns & Exploits 12Defense & AppSec 7DFIR 1AI Security 9Governance, Risk & Compliance 1Business & Boardroom 12

• Terabytes of credentials leaked in massive supply-chain attack
• ClickFix campaign abuses Deno runtime for infostealer delivery
• Sandworm hackers target IT pros with trojanized WireGuard VPN client

Threat Intel & Breaches 12Vulns & Exploits 12Offensive Research 2Defense & AppSec 8DFIR 1AI Security 12Governance, Risk & Compliance 5Business & Boardroom 6

• Shattering the Dream – When a Job Offer Becomes a Zero-Day Attack
• Hackers Breach Polish Power Plant Controls via Private Cellular Network and Shut Turbine
• Head Mare APT is exploiting vulnerabilities in an unpatched TrueConf server to deliver PhantomCore and PhantomGraph to video conference participants

Threat Intel & Breaches 12Vulns & Exploits 12Offensive Research 2Defense & AppSec 10DFIR 1AI Security 12Governance, Risk & Compliance 3Business & Boardroom 9

• #StopRansomware: Gunra Ransomware
• Abyssos: Technical Analysis of a New Modular RAT
• China-linked hackers turning popular cybersecurity tool into ransomware launchpad, Microsoft warns

Threat Intel & Breaches 6Vulns & Exploits 12Offensive Research 2Defense & AppSec 4DFIR 3AI Security 12Governance, Risk & Compliance 1Business & Boardroom 5

• CVE-2026-11976 (CVSS 10.0): The official MonsterInsights Pro update distribution bucket (`monster-insights.s3.amazonaws.com`) was compromised. Both the current release (10.2.2) a
• CVE-2026-17032 (CVSS 9.8): Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers
• Attackers Exploit N-able Patch Bypass Flaw on RMM Servers

Threat Intel & Breaches 12Vulns & Exploits 12Offensive Research 5Defense & AppSec 12DFIR 5AI Security 12Governance, Risk & Compliance 12Business & Boardroom 12

• ChainDrop supply chain compromise: Anatomy of a self-propagating worm
• Hackers breach TrueConf to trojanize client installers with backdoors
• Phoenix Rising: Exposing the PhaaS Kit Behind Global Mass Phishing Campaigns

Threat Intel & Breaches 12Vulns & Exploits 12Offensive Research 4Defense & AppSec 12AI Security 12

• Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages
• CVE-2026-66747 (CVSS 9.3), Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the op
• ChainDrop: Inside a Self-Propagating npm Worm