Senior Threat Intelligence Reporter
Daniel tracks ransomware crews, initial access brokers and state-aligned intrusion sets. He previously worked as a SOC analyst and still writes his own detection rules.
181 articles
MicrosoftMicrosoft discloses critical CVSS 10.0 flaw CVE-2026-69399 in Azure Arc, enabling unauthenticated attackers to exploit confused deputy proxies across hybrid cloud nodes.
Active ExploitAdobe and CISA warn of active exploitation targeting CVE-2026-71362 in Adobe Commerce and Magento, enabling unauthenticated manipulation of checkout orders and customer data.
Threat IntelWSO2 patches critical path traversal flaw CVE-2026-5430 across API Manager and Gateway platforms, preventing unauthenticated remote extraction of master credentials.
OT / SCADACISA ICS advisory ICSA-26-267-01 details critical flaws in Botslab G980H dashcams, allowing remote attackers to intercept live video and hijack fleet telematics.
OT / SCADAAn engineering deep dive into IEC 62443-3-2 zones and conduits, establishing hardware micro-segmentation and SL-T targets to protect physical industrial processes.
OT / SCADACISA ICS advisory ICSA-26-265-09 details critical buffer overflow and authentication bypass flaws in OpenPLC Runtime v3, allowing remote process disruption.
Data BreachIndia operationalizes DPDP Rules 2026, establishing Data Protection Board inquiries, mandatory resident DPOs, independent audits, and ₹250 Crore breach fines.
Active ExploitZyxel patches actively exploited stack buffer overflow flaw CVE-2026-7273 in GS1900 smart switches, enabling unauthenticated LAN attackers to execute arbitrary code.
OT / SCADACISA and Rockwell Automation issue advisory ICSA-26-244-03 for ControlLogix and CompactLogix PLCs where CIP message parsing flaws trigger fatal controller crashes.
Threat IntelSecuronix uncovers TASK#STOMP campaign leveraging Living-off-the-Land VBScript stagers, masqueraded Scheduled Tasks, and resilient dual-PowerShell backdoors.
OT / SCADASiemens ProductCERT issues advisory SSA-503852 for critical CVSS 9.1 flaw CVE-2026-18963 in Industrial Edge Management allowing unauthenticated attackers to seize administrative accounts.
OT / SCADACISA and Schneider Electric issue advisory for CVE-2025-6625 in Modicon M340 PLCs and BMX communication modules, where malformed FTP commands halt controller operations.
Threat IntelvLLM maintainers and NIST disclose critical CVSS 9.8 flaw CVE-2026-22778 in multimodal video processing allowing unauthenticated remote root takeover of GPU clusters.
GoogleGoogle Cloud and Linux maintainers patch CVE-2026-46300 (Fragnesia), a critical ESP-in-TCP kernel bug enabling container breakout to GKE node root.
AWS CloudAWS resolves high-severity CVSS 8.8 flaw CVE-2026-81849 in amazon-ssm-agent where crafted S3 object keys allow authenticated IAM actors to overwrite root host files.
Threat IntelVulnerability CVE-2026-67620 in Flowise AI workflow builder allows attackers to bypass SSRF deny-lists and extract cloud instance metadata credentials from OCI and Alibaba Cloud.
AWS CloudAWS resolves high-severity vulnerability CVE-2026-18830 in Amazon Bedrock AgentCore allowing attackers to bypass LLM safety guardrails and trigger arbitrary tool calls.
MicrosoftMicrosoft resolves maximum-severity CVSS 10.0 vulnerability CVE-2026-69836 in Entra ID allowing unauthenticated remote code execution via unsafe object deserialization.
AWS CloudAWS Labs resolves high-severity vulnerability CVE-2026-16584 in AWS API MCP Server allowing autonomous AI agent workflows to bypass security policies upon initialization failure.
AWS CloudAWS resolves high-severity vulnerabilities CVE-2026-89066 and CVE-2026-89065 in projen software project synthesis tooling allowing arbitrary command execution on developer workstations and CI runners.
AWS CloudAWS resolves high-severity vulnerability CVE-2026-92943 in AWS IoT Device SDK for Python allowing adversary-in-the-middle telemetry interception and message spoofing.
AWS CloudAWS patches high-severity flaw CVE-2026-86831 in Amazon EKS aws-network-policy-agent allowing unauthorized pod communication and network isolation bypass.
Data BreachIndia initiates DPDP Act Phase 2 enforcement establishing Data Protection Board inquiries, mandatory breach disclosures, and penalties up to ₹250 Crore.
AWS CloudAWS publishes security advisory ALAS2023LIVEPATCH-2026-343 addressing a Linux kernel vhost vring metadata cache corruption vulnerability (CVE-2026-74580).