Intelligence · Updated daily
AI-analysed threats, vulnerabilities and campaigns. Not just what happened — what it means, who's affected, and what to do about it.
Senator Ron Wyden is urging CISA, OMB, and NIST to coordinate a federal-wide removal of outdated VPN infrastructure from U.S. government agencies. Obsolete VPNs represent both a technical vulnerability surface and a compliance gap that threatens secure remote access across sensitive federal systems.
Attackers are exploiting an unpatched remote code execution vulnerability in FastJson, a widely-used Java serialisation library, to compromise US organisations without requiring user interaction or elevated privileges.
Internet-wide scanning activity has been observed against ESAFENET's CDG document management platform, exploiting known weaknesses including default credentials, SQL injection, and cross-site scripting. The product, popular in Chinese markets, exhibits preventable authentication and input validation flaws despite being marketed as a secure data leakage prevention solution.
The PEAR ransomware group claimed responsibility for stealing 3TB of data from MCBS, a medical business management company, affecting approximately 1.2 million individuals. This incident highlights the targeting of healthcare administrative infrastructure as a revenue source for organised ransomware operations.
GitHub and PyPI have added time-based verification mechanisms to Dependabot that detect when dependency updates deviate from expected release patterns, making it harder for attackers to inject malicious package versions into popular projects.
Attackers are exploiting CVE-2026-16723, an unauthenticated remote code execution flaw in Fastjson 1.x, against Spring Boot applications with no patch currently available from Alibaba. The vulnerability allows arbitrary code execution with Java process privileges.
A malvertising campaign targets users of financial and cryptocurrency platforms by hosting fake login pages that use JavaScript to assemble and execute malware directly in browser memory, bypassing traditional file-based detection mechanisms.
Rockwell Automation has released patches for code execution flaws in Arena simulation software that could allow attackers to compromise industrial organisations. The vulnerabilities are particularly concerning given Arena's role in critical infrastructure modelling and design.
SourTrade, a malvertising operation active since late 2024, distributes Windows malware in fragments across browser sessions, reassembling executables client-side using the legitimate Bun JavaScript runtime to bypass static URL-based detection. The campaign impersonates trading platforms to target retail traders.
Threat actors are posting fake technical support threads on Steam discussion forums linking to ClickFix malware, which executes XMRig cryptocurrency miners on victim systems. The attack exploits the high trust and technical audience of Steam's community to achieve broad distribution among gamers.
sm-crypto 0.4.0 falls back to Math.random() + wall-clock seeding for SM2 private key generation on Node.js because jsbn's SecureRandom checks window.crypto instead of globalThis.crypto. This renders all default SM2 keys cryptographically predictable.
Pheditor's forced password-change flow fails to verify the current password when the default admin password is unchanged, allowing unauthenticated attackers to set an arbitrary password and obtain a valid authenticated session.
Boards and CISOs report persistent communication gaps despite increased threat awareness forcing security up the priority agenda. Misalignment between executive expectations and security team capabilities creates governance and operational risk.
SecurityWeek's aggregate report covers multiple concurrent threats including Dolphin X AI-assisted malware, Siemens industrial switch vulnerabilities, a Russian Zimbra campaign, Linux kernel flaws, and ransomware extortion attempts. The breadth suggests attackers are expanding their targeting across consumer, industrial, and infrastructure domains simultaneously.
North Korean threat actor BlueNoroff is running a sophisticated phishing campaign that impersonates Zoom and Microsoft Teams via typosquatted domains to profile cryptocurrency wallet holders before delivering malware. The operation combines trusted industry contact compromise with social engineering to increase success rates.
The UK's new Prime Minister Keir Starmer has retained Liz Lloyd in a cyber policy role despite dissolving her previous ministry, indicating continuity in national cyber governance rather than substantive policy change. This retention of a key Starmer ally in a reduced capacity suggests cyber remains a government priority whilst undergoing organisational restructuring.
OnTrac, a major US parcel delivery provider, suffered a network breach allowing attackers to access customer personal data. This represents a significant supply chain risk affecting businesses and individuals relying on the carrier.
Auth.js email normalizer validates email addresses before applying Unicode normalization, allowing attackers to bypass the single-@-symbol check using Unicode homoglyphs that canonicalize to @. This enables account takeover via magic-link misdirection to attacker-controlled addresses.
Cisco Talos analysis of Q2 2026 vulnerability statistics reveals a saturation point in patch management where organisations attempting to remediate everything face resource exhaustion and reduced security outcomes. Intelligent triage and risk-based patching now outperforms comprehensive patch deployment.
Attackers have compromised Origin Energy, Australia's largest energy retailer, and exfiltrated personal data on approximately 2 million customers. The breach targets critical infrastructure and demonstrates ongoing vulnerability in essential services.
A Russian espionage group exploited an unknown flaw in Zimbra webmail to harvest email, directory data, and 2FA recovery codes from Western organisations over an extended period. The attack required only message open to trigger payload execution.
Russia-linked Laundry Bear has deployed zero-click phishing attacks against Zimbra webmail users globally, exploiting the platform's ubiquity in enterprise and government environments to establish initial access for credential harvesting and lateral movement.
Dolphin X, a new remote access trojan, incorporates machine learning to profile and rank infected hosts by value, enabling attackers to concentrate resources on high-yield targets. This represents a meaningful shift toward data-driven targeting in commodity malware.
SentinelOne Labs benchmarked whether large frontier AI models can maintain investigative integrity during long-horizon malware analysis tasks when new evidence contradicts prior reasoning. The research highlights fundamental reliability gaps in autonomous AI-driven security analysis.
US federal agencies have published updated advisory detailing techniques used by Iranian-linked threat actors to compromise programmable logic controllers from major industrial automation vendors, with direct implications for critical infrastructure security.