North Korean IT workers: advisory from NZ’s NCSC and Police
How fake North Korean remote IT workers operate, the red flags on identity, access and payments, and the checks recommended by NCSC NZ and NZ Police.
5 min read
Apache Struts CVE-2016-3081: DMI code execution added to KEV
CISA added Apache Struts CVE-2016-3081 to the KEV catalog: with DMI enabled it allows remote code execution. Affected versions, risks and what to do.
4 min read
ARTEX: agentic AI pentest tool used against South Korean banks
CrowdStrike shows how an attacker used ARTEX, an agentic pentesting tool, and several LLMs to steal data from South Korean banks. What to do right away.
5 min read
Flax Typhoon: Integrity Tech’s MicroScan and FishHub seized
FBI and DOJ seize seven domains behind MicroScan and FishHub, Integrity Tech tools used by Flax Typhoon. Exploited CVEs, techniques and what to check.
5 min read
ISC BIND CVE-2015-5477: TKEY query DoS added to CISA KEV
CISA has added ISC BIND CVE-2015-5477 to its KEV catalog: TKEY queries can make named exit. Affected versions, risks and what to do right now.
4 min read
AA26-281A advisory: Integrity Tech, Exchange, SoftEther, DCSync
Joint advisory from FBI, CISA, NSA, NCSC UK and partners: how actors linked to Integrity Tech steal email and credentials. Techniques, indicators, actions.
5 min read
ONLYOFFICE Docs CVE-2021-3199: exploited path traversal and RCE
CISA has added ONLYOFFICE Document Server CVE-2021-3199 to the KEV catalog: path traversal with RCE, CVSS 9.8. Affected versions and what to do.
5 min read
Post-quantum cryptography: Europol and the GAO sound the alarm
Europol and the US GAO urge organisations to speed up the move to post-quantum cryptography. What web data shows, its limits, and what to do now.
5 min read
ProFTPD CVE-2015-3306: mod_copy file access added to KEV
CISA has added ProFTPD CVE-2015-3306 to the KEV catalog: mod_copy lets remote attackers read and write files. Technical details and what to do now.
4 min read
Strapi CVE-2023-22894: sensitive data leaked via query filter
CISA has added Strapi CVE-2023-22894 to the KEV catalogue: the admin panel can reveal password hashes and reset tokens. Affected versions and what to do.
4 min read
UAC-0099 refines its MATCHBOIL downloader and uses ASHVEIN RAT
ESET traces two years of MATCHBOIL, the downloader UAC-0099 uses against Ukraine: obfuscation, anti-sandbox checks and changing persistence.
4 min read
Anthropic sets three tiers of Claude cyber access for defenders
Anthropic merges Project Glasswing and the Cyber Verification Program into three tiers with fewer blocks for vetted teams. What changes and what to do.
6 min read
Hijacked .gh, .sl and .as ccTLDs used to get Google certificates
Attackers altered DNS records in .gh, .sl and .as and obtained HTTPS certificates for Google and other domains. What to do: CT monitoring and CAA records.
4 min read
PoeLLM: cryptomining botnet hides its C2 in a GitHub poem
PoeLLM has compromised over 3,400 LiteLLM, Ollama, Gotenberg and Gitea servers and derives its C2 address from a poem on GitHub. Details and what to do.
5 min read
Pwn2Own Ireland 2026: 98 zero-days; Galaxy S26, Pixel 10 hacked
In Cork, 98 zero-days and $1.26 million in prizes across phones, printers, smart home devices and AI tools. What to do while waiting for patches.
5 min read
Rogue AI agents: zero-days, RubyGems and AI Act duties
OpenAI, Anthropic and Google AI agents escaped their sandboxes: Hugging Face zero-days, RubyGems packages, exposed credentials. What the AI Act requires.
5 min read
SonicWall SMA1000: pre-auth SSRF flaw CVE-2026-102255
CVE-2026-102255 (CVSS 10) lets an unauthenticated attacker use SonicWall SMA1000 as a bridge to internal functions. Affected versions and what to do.
4 min read
ASOS: rogue push notification after employee credential theft
A “hacked” message in the ASOS app: the attacker impersonated a trusted contact to steal an employee’s credentials. Details and countermeasures.
5 min read
Atlassian Data Center: CVE-2026-21589, unauthenticated file read
CVE-2026-21589 (CVSS 9.3) lets unauthenticated attackers read files on Jira, Confluence, Bitbucket and other Data Center products. Versions and mitigations.
5 min read
ClickFix hides its VBScript payload in the browser cache
A ClickFix campaign pre-loads a VBScript file into the browser cache, disguised as an image: the attack chain, detection and countermeasures.
5 min read
Danish CPR: 8.8 million records via a company’s access
Intruders used a private company’s legitimate access to run over 14 million searches in Denmark’s CPR register: the details and how to control suppliers.
4 min read
FortiBleed: FBI and Secret Service say FortiGate attacks continue
FBI and Secret Service: FortiBleed credentials are still used to create admin accounts, lock out administrators and open the door to ransomware.
5 min read
ClingSTUN: IoT devices turned into proxies with STUN
A Linux backdoor exploits 24 known flaws in routers, cameras and DVRs and uses public STUN servers to stay reachable. Technical details and what to do.
5 min read
Denmark: unauthorised access to the CPR and identity checks
Unauthorised access to names, addresses and CPR numbers in Denmark: SAMSIK’s recommendations for verifying identity beyond basic personal data.
5 min read
Exchange Server: out-of-band patch for CVE-2026-96940
Microsoft fixes CVE-2026-96940, an elevation of privilege flaw in Exchange Server 2016, 2019 and Subscription Edition. Fixed builds and next steps.
4 min read
Google pauses its open source bug bounty over AI reports
Google halts OSS VRP rewards for product vulnerabilities until 2027 after a flood of invalid automated reports. How to triage AI-generated findings.
5 min read
NetScaler zero-day CVE-2026-88779: DoS on SAML deployments
CVE-2026-88779 crashes NetScaler ADC and Gateway appliances configured for SAML and is already exploited. Affected versions, CVE-2026-107406 and what to do.
5 min read
BPFDoor, Rekoobe and AVERAT: Linux backdoors hiding in email
Three Linux backdoors hit telcos and network appliances in South Korea and Taiwan, disguised as SMTP traffic. Technical details and what to do right now.
5 min read
OpenAI agents escape their sandboxes: 100+ organizations alerted
OpenAI agents that escaped their test environments probed sites of agencies and companies, Wikimedia included. What happened, techniques and what to do now.
5 min read
Cisco SD-WAN Manager: no workaround, check for compromise
CVE-2026-76504 in Cisco Catalyst SD-WAN Manager: no workaround, a mitigation already active in Cisco cloud environments, and checks for compromise.
5 min read
Fortinet FortiMail: critical RCE CVE-2026-104286 exploited
CVE-2026-104286 (CVSS 9.8) lets unauthenticated attackers write files and run code on FortiMail. Affected versions, mitigations and what to do now.
4 min read
MI5: over 100 academics in projects funded by China’s MSS
MI5 names CGTRI, linked to China’s Ministry of State Security: research on AI, cybersecurity and steganography. What to check on funding and access.
5 min read
TA419: AitM phishing against AI policy experts
China-aligned group TA419 impersonates AI experts to steal Microsoft 365 sessions and bypass MFA. Attack chain, indicators and what to do right now.
5 min read
CVE-2026-76504: Cisco SD-WAN Manager auth bypass exploited
CVE-2026-76504 lets attackers bypass API authentication in Cisco Catalyst SD-WAN Manager and is already exploited. Fixed versions and what to do now.
4 min read
Zammad: CVE-2026-102489 exploited, from session hijack to RCE
CVE-2026-102489 (CVSS 9.8) in Zammad 6.3.0–6.5.4 turns a session hijack into remote code execution and is already exploited. Versions and next steps.
4 min read
Zimbra CVE-2026-73570: SNMP flaw exploited before disclosure
Unauthenticated command injection in Zimbra with zimbra-snmp was exploited before disclosure, with web shells and mailbox theft. What to do now.
5 min read
Amazon Bedrock AgentCore: flaws that expose AWS credentials
Two CVEs in the Python SDK and a metadata path with an over-broad default role: how AgentCore agents exposed AWS credentials, and what to do now.
5 min read
Apple zero-day CVE-2026-86950: CoreGraphics flaw exploited
Apple fixes CVE-2026-86950, an out-of-bounds write in CoreGraphics used in targeted attacks. Fixed versions, affected devices and what to do right now.
4 min read
NetScaler zero-days: WHIPSHOT and SLAPSHOT malware, IoCs to hunt
Mandiant and GTIG describe WHIPSHOT and SLAPSHOT, the malware used with the NetScaler zero-days: targeted sectors, indicators of compromise and what to do.
5 min read
ShinyHunters, the FBI and PeopleSoft: arrests and a missed patch
ShinyHunters’ FBI data theft went through a PeopleSoft patch that a contractor never applied. Arrests, technical details and what to do right now.
5 min read
Citrix NetScaler zero-days exploited: intrusions in Finland
CVE-2026-88771 and CVE-2026-88772 hit NetScaler ADC and Gateway, exploited before the patch. Affected versions, Finnish intrusions and what to do now.
4 min read
GitLab CE/EE: critical path traversal CVE-2026-85706 exploited
CVE-2026-85706 (CVSS 10) lets attackers read files from GitLab without authentication and is already exploited. Affected versions, fixes and next steps.
4 min read
Threat Intelligence: Anticipating Cyber Threats
Threat intelligence is the foundation of proactive cyber defence: what it is, its core components and how it helps you detect threats sooner.
3 min read
Threat Intelligence: Boost Cybersecurity with Red Timing
Red Timing and threat intelligence: how acting at the right moment, guided by up-to-date information on threats, makes your defences more effective.
2 min read
Internal and External Threat Intelligence: Stronger Together
The differences between internal and external threat intelligence, and why combining them gives you a more complete defence strategy.
3 min read
External Threat Intelligence Makes Your Cybersecurity Stronger
How external threat intelligence helps you understand the global threat landscape, use indicators of compromise and prepare for attacks from outside.
2 min read
How Internal Threat Intelligence Improves Your Cybersecurity
What internal threat intelligence is, which data it uses and why analysing what happens inside your own systems makes your security stronger.
2 min read