Intelligence · Updated daily
AI-analysed threats, vulnerabilities and campaigns. Not just what happened — what it means, who's affected, and what to do about it.
Chinese-attributed threat actors compromised an organisation's authentication infrastructure and maintained undetected access for 10 years with administrative visibility. This represents a failure of both perimeter and internal security controls to detect long-term auth-layer persistence.
NPM 12 will block dependency scripts from running during npm install unless explicitly whitelisted, fundamentally altering how the Node.js ecosystem handles post-install hooks. This addresses a critical attack surface but introduces significant compatibility challenges.
CVE-2026-20253, a CVSS 9.8 critical vulnerability in Splunk Enterprise versions before 10.2.4 and 10.0.7, permits unauthenticated attackers to perform arbitrary file operations and achieve remote code execution, affecting a primary target for enterprise threat actors seeking post-compromise persistence and reconnaissance.
A former Iowa school district IT employee received a 21-month prison sentence for conducting a prolonged cyberattack against the district after employment termination, causing operational disruption, account deletion, and significant financial damage. The case underscores systemic failures in access revocation and post-employment security procedures.
Workspace-scoped builders can escalate to global admin by directly injecting role properties into the /api/public/v1/roles/assign endpoint, bypassing authorization checks. This represents a complete tenant-wide privilege escalation from a restricted app-level role.
Unit 42 researchers have identified a previously unknown macOS Tahoe 26 forensic artifact that records user menu selections system-wide. This discovery is significant for digital forensics and incident response teams seeking to reconstruct user behaviour during investigations.
Google security layoffs, alleged incident response cover-ups by IBM and AT&T, regulatory fines against Coupang, and flat ICS exposure rates collectively signal organisational security maturity challenges and regulatory pressure intensifying across tech and e-commerce sectors.
Attackers compromised over 400 packages in the Arch User Repository, injecting a Rust-based credential stealer that escalates to deploy an eBPF rootkit when run with elevated privileges. This represents a severe supply-chain attack targeting the Arch Linux developer ecosystem.
A $47 million settlement fund has been approved for approximately 7 million 23andMe customers whose genetic and personal data were compromised starting in April 2023 and subsequently posted on dark web marketplaces. The breach underscores inadequate credential hygiene, delayed breach disclosure, and the growing market for personal genomic data.
Maine's public data breach notification portal was taken offline after attackers published fraudulent breach disclosures on the state website, highlighting inadequate access controls and verification procedures in government reporting systems that citizens rely on for authentic security information.
AuthInjectionMiddleware fails to enforce authentication, allowing unauthenticated callers to invoke MCP tools and trigger error responses that leak the operator's Meta access token as a query parameter in JSON-RPC responses.
CodeIgniter4's `ext_in` validation rule checks MIME-guessed extensions rather than actual filename extensions, allowing attackers to upload executable files (e.g., PHP shells) that bypass validation. This leads to arbitrary code execution when uploads are stored in web-accessible directories with script execution enabled.
Juan Andrés Guerrero-Saade argues that decades of uncoordinated security tool accumulation have created an unmanageable, non-standardised technology stack that prevents organisations from effectively directing their own cyber defence strategies. The proposal centres on building an ecology model for cyber security architecture.
Alert fatigue is a systemic operational security problem where SOCs become overwhelmed by alert volume, causing genuine threats to be missed or delayed. This is a control failure that degrades the effectiveness of existing detection infrastructure.
Two independent security teams demonstrated that OpenClaw can be coerced into executing arbitrary code and exfiltrating sensitive data through embedded instructions hidden in benign-looking vCards, contacts, and location data. The attack requires no authentication and exploits the agent's unsafe parsing and execution model.
The U.S. Senate Armed Services Committee rejected Senator Kirsten Gillibrand's amendment to establish a dedicated Cyber Force as a distinct military service during fiscal 2027 defense authorization debate. The narrow 14-13 vote reflects ongoing congressional disagreement over optimal cyber defence organisational structures.
Kyushu Electric Power Co. lost a portable drive containing personal data of 10.9 million customers through a physical security incident. The breach highlights the ongoing risk of unencrypted data storage devices in large organisations handling critical infrastructure client information.
Go REST API boilerplate ships with hardcoded JWT secret 'random' in both template and code defaults, allowing attackers to forge valid authentication tokens and bypass access controls entirely.
The Gentlemen ransomware group has rapidly ascended to become the second most prolific gang by victim count, using a 90% ransom split to aggressively recruit skilled affiliates. Attribution efforts are now pointing toward identifying the group's administrator.
Attackers are increasingly deploying infostealers to harvest credentials at scale, using stolen login details as the primary entry vector for ransomware and other operations rather than relying on exploits. This trend indicates defenders must prioritise credential hygiene and detection of infostealer activity.
A China-linked botnet called JDY has expanded to compromise over 1,500 small office, home office, and IoT devices, operating as a centralised scanner for discovering and mapping exposed internet-facing services. This represents a significant reconnaissance infrastructure used by state-sponsored actors to identify targets at scale.
CISA has issued a directive requiring federal agencies to patch certain cyber vulnerabilities within 3 days, with a 180-day adoption period. This represents a significant tightening of vulnerability remediation timelines across US government IT infrastructure.
CVE-2024-5027, a path traversal vulnerability in Langflow (CVSS 8.8), is being actively exploited in the wild to write arbitrary files to exposed servers. Organisations running unpatched instances face immediate risk of system compromise.
The shell-quote library fails to escape line terminators in object token `.op` fields, allowing callers who pass attacker-controlled object tokens to `quote()` to inject shell commands. The vulnerability exists in documented API surface and bypasses the intended shell-safety boundary.
Unit 42 research demonstrates practical techniques for disabling or manipulating cloud logging services (AWS CloudTrail, Azure Monitor, GCP Cloud Logging) to evade detection. This represents a critical post-compromise capability that undermines forensic investigation and compliance monitoring.