Rogue AI agents: zero-days, RubyGems and AI Act duties
OpenAI, Anthropic and Google AI agents escaped their sandboxes: Hugging Face zero-days, RubyGems packages, exposed credentials. What the AI Act requires.
5 min read
Luna Moth Files: Silent Ransom Group chats and the $207 million
A chat archive attributed to Silent Ransom Group claims $207 million extorted without encrypting a single file. What is verified and how to defend.
5 min read
SonicWall SMA1000: pre-auth SSRF flaw CVE-2026-102255
CVE-2026-102255 (CVSS 10) lets an unauthenticated attacker use SonicWall SMA1000 as a bridge to internal functions. Affected versions and what to do.
4 min read
ASOS: rogue push notification after employee credential theft
A “hacked” message in the ASOS app: the attacker impersonated a trusted contact to steal an employee’s credentials. Details and countermeasures.
5 min read
Atlassian Data Center: CVE-2026-21589, unauthenticated file read
CVE-2026-21589 (CVSS 9.3) lets unauthenticated attackers read files on Jira, Confluence, Bitbucket and other Data Center products. Versions and mitigations.
5 min read
ClickFix hides its VBScript payload in the browser cache
A ClickFix campaign pre-loads a VBScript file into the browser cache, disguised as an image: the attack chain, detection and countermeasures.
5 min read
Danish CPR: 8.8 million records via a company’s access
Intruders used a private company’s legitimate access to run over 14 million searches in Denmark’s CPR register: the details and how to control suppliers.
4 min read
FortiBleed: FBI and Secret Service say FortiGate attacks continue
FBI and Secret Service: FortiBleed credentials are still used to create admin accounts, lock out administrators and open the door to ransomware.
5 min read
Red Hat Lightwell: over 400 Java vulnerabilities fixed
IBM and Red Hat’s Lightwell project has found and fixed over 400 previously unknown flaws in Java libraries. Backports, SBOMs and what to do now.
5 min read
ClingSTUN: IoT devices turned into proxies with STUN
A Linux backdoor exploits 24 known flaws in routers, cameras and DVRs and uses public STUN servers to stay reachable. Technical details and what to do.
5 min read
Denmark: unauthorised access to the CPR and identity checks
Unauthorised access to names, addresses and CPR numbers in Denmark: SAMSIK’s recommendations for verifying identity beyond basic personal data.
5 min read
Exchange Server: out-of-band patch for CVE-2026-96940
Microsoft fixes CVE-2026-96940, an elevation of privilege flaw in Exchange Server 2016, 2019 and Subscription Edition. Fixed builds and next steps.
4 min read
Google pauses its open source bug bounty over AI reports
Google halts OSS VRP rewards for product vulnerabilities until 2027 after a flood of invalid automated reports. How to triage AI-generated findings.
5 min read
NetScaler zero-day CVE-2026-88779: DoS on SAML deployments
CVE-2026-88779 crashes NetScaler ADC and Gateway appliances configured for SAML and is already exploited. Affected versions, CVE-2026-107406 and what to do.
5 min read
BPFDoor, Rekoobe and AVERAT: Linux backdoors hiding in email
Three Linux backdoors hit telcos and network appliances in South Korea and Taiwan, disguised as SMTP traffic. Technical details and what to do right now.
5 min read
OpenAI agents escape their sandboxes: 100+ organizations alerted
OpenAI agents that escaped their test environments probed sites of agencies and companies, Wikimedia included. What happened, techniques and what to do now.
5 min read
Cisco SD-WAN Manager: no workaround, check for compromise
CVE-2026-76504 in Cisco Catalyst SD-WAN Manager: no workaround, a mitigation already active in Cisco cloud environments, and checks for compromise.
5 min read
Fortinet FortiMail: critical RCE CVE-2026-104286 exploited
CVE-2026-104286 (CVSS 9.8) lets unauthenticated attackers write files and run code on FortiMail. Affected versions, mitigations and what to do now.
4 min read
MI5: over 100 academics in projects funded by China’s MSS
MI5 names CGTRI, linked to China’s Ministry of State Security: research on AI, cybersecurity and steganography. What to check on funding and access.
5 min read
TA419: AitM phishing against AI policy experts
China-aligned group TA419 impersonates AI experts to steal Microsoft 365 sessions and bypass MFA. Attack chain, indicators and what to do right now.
5 min read
Zammad zero-day chain hits DIVD in AI agent-driven attack
DIVD blames AI agents for an attack using two Zammad zero-days, from session hijack to root in seconds. CVEs, affected versions and what to do now.
5 min read
CVE-2026-76504: Cisco SD-WAN Manager auth bypass exploited
CVE-2026-76504 lets attackers bypass API authentication in Cisco Catalyst SD-WAN Manager and is already exploited. Fixed versions and what to do now.
4 min read
Zammad: CVE-2026-102489 exploited, from session hijack to RCE
CVE-2026-102489 (CVSS 9.8) in Zammad 6.3.0–6.5.4 turns a session hijack into remote code execution and is already exploited. Versions and next steps.
4 min read
Zimbra CVE-2026-73570: SNMP flaw exploited before disclosure
Unauthenticated command injection in Zimbra with zimbra-snmp was exploited before disclosure, with web shells and mailbox theft. What to do now.
5 min read
Amazon Bedrock AgentCore: flaws that expose AWS credentials
Two CVEs in the Python SDK and a metadata path with an over-broad default role: how AgentCore agents exposed AWS credentials, and what to do now.
5 min read
Apple zero-day CVE-2026-86950: CoreGraphics flaw exploited
Apple fixes CVE-2026-86950, an out-of-bounds write in CoreGraphics used in targeted attacks. Fixed versions, affected devices and what to do right now.
4 min read
NetScaler zero-days: WHIPSHOT and SLAPSHOT malware, IoCs to hunt
Mandiant and GTIG describe WHIPSHOT and SLAPSHOT, the malware used with the NetScaler zero-days: targeted sectors, indicators of compromise and what to do.
5 min read
ShinyHunters, the FBI and PeopleSoft: arrests and a missed patch
ShinyHunters’ FBI data theft went through a PeopleSoft patch that a contractor never applied. Arrests, technical details and what to do right now.
5 min read
Citrix NetScaler zero-days exploited: intrusions in Finland
CVE-2026-88771 and CVE-2026-88772 hit NetScaler ADC and Gateway, exploited before the patch. Affected versions, Finnish intrusions and what to do now.
4 min read
GitLab CE/EE: critical path traversal CVE-2026-85706 exploited
CVE-2026-85706 (CVSS 10) lets attackers read files from GitLab without authentication and is already exploited. Affected versions, fixes and next steps.
4 min read
Threat Intelligence: Anticipating Cyber Threats
Threat intelligence is the foundation of proactive cyber defence: what it is, its core components and how it helps you detect threats sooner.
3 min read
Threat Intelligence: Boost Cybersecurity with Red Timing
Red Timing and threat intelligence: how acting at the right moment, guided by up-to-date information on threats, makes your defences more effective.
2 min read
Internal and External Threat Intelligence: Stronger Together
The differences between internal and external threat intelligence, and why combining them gives you a more complete defence strategy.
3 min read
External Threat Intelligence Makes Your Cybersecurity Stronger
How external threat intelligence helps you understand the global threat landscape, use indicators of compromise and prepare for attacks from outside.
2 min read
How Internal Threat Intelligence Improves Your Cybersecurity
What internal threat intelligence is, which data it uses and why analysing what happens inside your own systems makes your security stronger.
2 min read