Intelligence · Updated daily
AI-analysed threats, vulnerabilities and campaigns. Not just what happened — what it means, who's affected, and what to do about it.
MuddyWater, an Iranian state-linked threat actor, has conducted a coordinated espionage campaign in Q1 2026 targeting organisations across industrial manufacturing, education, public sector, finance, and professional services in nine countries using DLL side-loading techniques.
Foreign attackers gained unauthorised access to 600,000 records from Lithuania's Centre of Registers, which manages property and legal entity data. This represents a significant compromise of state administrative infrastructure with potential implications for identity fraud and state surveillance.
A previously unknown vulnerability in KnowledgeDeliver LMS was exploited in the wild to install Godzilla web shells on victim servers. This represents active compromise of educational infrastructure with potential for persistent access and lateral movement.
A phishing campaign is distributing ACR Stealer through fake Claude AI pages. This represents an active social engineering threat targeting users seeking legitimate AI tools.
Dutch authorities arrested two co-owners of Internet hosting companies and seized approximately 800 servers used by Russian intelligence to stage cyberattacks, influence operations, and disinformation campaigns targeting the EU. The action disrupts a significant portion of Russia's operational infrastructure in Europe.
A vulnerability in Ghost CMS has been exploited to compromise over 700 websites, including those of Harvard, Oxford, and DuckDuckGo. This represents a significant supply-chain risk given Ghost's prevalence among high-profile organisations.
A high-severity flaw in Digital Knowledge's KnowledgeDeliver LMS, stemming from hard-coded ASP.NET machine keys, was exploited in the wild to install Godzilla web shells and subsequently Cobalt Strike Beacon. The vulnerability has been patched but likely saw active abuse before disclosure.
Anthropic is preparing to integrate its Mythos model into Claude Code, a restricted model previously flagged for security risks in software development contexts. This marks a shift from controlled deployment to broader availability with unclear safety mitigations.
Mandiant identified a critical remote code execution vulnerability in KnowledgeDeliver, a Learning Management System widely deployed in Japanese educational institutions, exploitable through unsafe .NET ViewState deserialisation. Active exploitation has been confirmed in the wild.
Wireshark 4.6.6 was released on 24 May, patching one vulnerability alongside 11 bug fixes. This is routine vendor maintenance with limited security impact.
Google's threat intelligence team identified a dozen mature phishing-as-a-service offerings operating in Chinese-language underground forums, representing a significant shift in the geographic distribution of PhaaS infrastructure and suggesting intensified credential theft campaigns targeting organisations with Asia-Pacific exposure.
Attackers are exploiting a critical SQL injection flaw (CVE-2026-26980) in Ghost CMS to inject malicious JavaScript that delivers ClickFix social engineering attacks at scale. This combines server-side code execution with client-side manipulation, significantly amplifying attack reach.
Italian authorities shut down CINEMAGOAL, a piracy application that harvested authentication credentials from Netflix, Disney+, Spotify and other streaming services to provide unauthorised access. The operation represents a significant credential-theft infrastructure targeting consumer accounts at scale.
Threat actors are operating fake FIFA websites mimicking official ticket and merchandise sales platforms to harvest payment card data and personal information from World Cup fans. This represents a high-volume, low-sophistication fraud operation capitalised on major sporting events.
A DNS vulnerability called Underminr affects approximately 88 million domains and allows attackers to hide malicious traffic behind legitimate domain names, bypassing DNS filtering and exfiltrating data undetected.
npm has released staged publishing, a feature requiring 2FA-gated approval before package releases become public, reducing the window for automated supply chain attacks. This represents incremental hardening of package distribution rather than addressing fundamental dependency resolution risks.
Attackers compromised Laravel Lang localisation packages on Composer by exploiting GitHub version tags to inject credential-stealing malware, directly exposing developer environments to post-compromise exfiltration. This represents a high-risk supply chain breach affecting a widely-used ecosystem package.
An unauthenticated SQL injection flaw in YesWiki's FormManager allows attackers to inject arbitrary SQL via the `bn_id_nature` parameter, enabling full database exfiltration including password hashes. The PoC demonstrates reliable, pre-authentication exploitation against default installations.
FileBrowser's public PATCH endpoint joins user-controlled paths with the share root before sanitization, allowing traversal outside the intended directory. Public shares with modification enabled are immediately exploitable.
Nezha's cron scheduling API routes are protected by common authentication (any logged-in user) rather than admin-only gates, combined with a permission check bypass that allows RoleMembers to execute arbitrary commands on all monitored servers across tenant boundaries.
A CISA contractor intentionally published AWS GovCloud credentials and classified agency materials to a public GitHub repository, forcing CISA into active remediation whilst Congress demands accountability for what appears to be a deliberate insider breach.
Drupal has confirmed active exploitation of CVE-2026-9082 with security firms detecting attacks against thousands of websites shortly after public disclosure. The rapid weaponisation indicates this is a severe vulnerability with immediate real-world impact.
European and North American authorities have shut down First VPN, a criminal VPN service that facilitated ransomware attacks, data theft, and DDoS operations for approximately 25 ransomware groups. The coordinated takedown represents a significant disruption to organised cybercrime infrastructure, though similar services remain operational.
The FBI has warned of Kali365, a Telegram-based phishing-as-a-service platform that captures legitimate OAuth tokens to gain unauthorised access to Microsoft 365 environments. The service has been actively used in campaigns since at least April 2024.
Dutch financial crime authorities arrested two operators and seized 800 servers from a web hosting company that provided infrastructure for coordinated cyberattacks, interference campaigns, and disinformation operations. This represents a significant disruption to a criminal supply chain enabling multiple threat actors.