Senior Threat Intelligence Reporter
Daniel tracks ransomware crews, initial access brokers and state-aligned intrusion sets. He previously worked as a SOC analyst and still writes his own detection rules.
181 articles
Threat IntelCISA adds SimpleHelp remote support platform vulnerability CVE-2026-48558 (CVSS 9.8) to KEV catalog following active exploitation against enterprise networks.
FortinetCISA adds Fortinet FortiSandbox vulnerabilities CVE-2026-25089 and CVE-2026-39808 (CVSS 9.8) to KEV following active attacks against enterprise security fabrics.
OT / SCADACISA ICS-CERT advisory ICSA-26-258-05 alerts power grid operators to critical denial of service flaws in Siemens Reyrolle 7SR5 electrical protection relays.
Threat IntelCISA flags Apache Tomcat vulnerability CVE-2026-34486 exploited in enterprise intrusions to intercept unencrypted session tokens and hijack authenticated user access.
OT / SCADACISA ICS-CERT advisory ICSA-26-258-01 prompts urgent implementation of IEC 62443-3-2 zone segmentation and Purdue Model controls in industrial networks.
Check PointCISA orders emergency remediation of Check Point SmartConsole flaw CVE-2026-16232, which allows network adversaries to bypass authentication on management servers.
MicrosoftCISA flags Microsoft Active Directory Federation Services vulnerability CVE-2026-56155 (CVSS 9.8) exploited in attacks forging SAML claims across hybrid Azure clouds.
Threat IntelCISA mandates immediate remediation of CVE-2026-18556, an unauthenticated alternate path bypass in N-able N-central allowing full MSP administrative takeover.
MicrosoftCISA warns of in-the-wild exploitation of CVE-2026-68820, a use-after-free vulnerability in the Windows Ancillary Function Driver (afd.sys) granting SYSTEM privilege.
Active ExploitCISA adds CVE-2026-9198 to KEV, warning of active remote code injection attacks weaponizing visual AI workflow builder IBM Langflow in enterprise environments.
Data BreachThe Data Protection Board of India establishes mandatory breach disclosure workflows, Significant Data Fiduciary obligations, and statutory ₹250 Crore penalties.
Active ExploitCISA issues an emergency directive on CVE-2025-62593, warning that unauthenticated code injection in Ray AI distributed computing clusters allows adversaries to seize GPU clusters and training models.
MicrosoftFederal agencies and enterprise operators face urgent deadlines as CISA confirms active exploitation of CVE-2021-23758, an unauthenticated deserialization RCE in Ajax.NET Professional.
Threat IntelCISA warns of active exploitation targeting enterprise video conferencing systems via CVE-2026-72530, an unauthenticated remote code injection flaw on TrueConf port 4307.
Threat IntelCISA issues binding remediation directive on CVE-2026-60004, a critical code injection defect in Gitea's git diffpatch parser enabling remote command execution on self-hosted repositories.
LinuxCISA added CVE-2026-53362 to its KEV catalog, warning of active privilege escalation exploits targeting the Linux Kernel IPv6 networking subsystem across major enterprise distros.
OT / SCADACISA issued an energy sector ICS advisory warning of memory corruption and authentication defects in AVEVA Pipeline Integrity Monitor supervising oil and gas transport.
Gov / DefenseA joint cybersecurity advisory from CISA, NSA, and FBI alerts defense contractors and cloud vendors to sophisticated state-sponsored AI model extraction campaigns.
CiscoCisco resolved CVE-2026-20274, an unauthenticated memory corruption flaw in IOS XR software that enables crash-loops or remote code execution in telecommunications cores.
Citrix NetScalerCISA and threat researchers warn that CVE-2026-19490 in Citrix NetScaler ADC and Gateway is under active exploitation, granting unauthenticated access to perimeter gateways.
DevSecOpsGitHub’s new ruleset can block pull-request merges until selected secret-scanning alerts are resolved, adding a review-stage guard beyond push protection.
CiscoThreat actors and Qilin ransomware affiliates are actively weaponizing CVE-2026-20079 in Cisco Secure FMC to bypass web authentication and achieve root command execution.
Threat IntelCERT Polska discloses MikroTrick, an unauthenticated exploit chain hijacking MikroTik RouterOS devices, while CISA adds a dangerous ScreenConnect client condition to KEV.
LinuxRapid7 Labs uncovers TED, an elusive Linux implant compiled directly into HAProxy load balancers at automotive and media firms, hiding C2 and manipulating live traffic.