1,167 articles
Deep DiveUnit 42 documented six new RAT variants from Iran-nexus Screening Serpens between February and April 2026. The hashes rotate; the AppDomainManager config file does not.
Threat IntelCISA issued an emergency KEV addition for CVE-2026-86218, an unauthenticated static code injection flaw in N-able N-central RMM servers actively exploited against MSP networks.
VulnerabilityTwo of this year’s fastest CISA remediation deadlines hit devices that cannot run EDR. A practical checklist for the class attackers reach for first.
Palo AltoA newly catalogued authentication bypass in Palo Alto Networks PAN-OS lets an unauthenticated attacker reach management functionality. Here is the exposure and the fix.
LinuxRed Hat patched CVE-2026-76578 (CVSS 9.8) in FreeIPA and 389 Directory Server, where an LDAP Access Control Instruction flaw allowed unauthenticated clients to create permanent domain admins.
DevSecOpsA practical, ordered checklist for defending against malicious packages and install-time credential theft — with the exact commands and settings.
Deep DiveWith 99% of SaaS compromises originating at the identity provider, MFA is no longer the control organisations think they bought. Here is what changed.
Deep DiveThe 2026 benchmark from foothold to active exfiltration is 72 minutes, a fourfold reduction. Human-paced triage no longer fits inside the window.
DevSecOpsA self-propagating worm compromised hundreds of popular npm packages, harvesting cloud keys and CI tokens then using them to publish further poisoned releases.
Four high-severity vulnerabilities in widely deployed enterprise software — including a build-artefact repository that sits directly in the software supply chain.
DevSecOpsA campaign beginning in late June 2026 built hundreds of fake brand repositories on GitHub and used SEO to place them at the top of software download searches.
CiscoCisco disclosed CVE-2026-20212 (CVSS 9.8), an unauthenticated root code execution flaw on Silicon One-based Nexus 9000 datacenter switches due to open debugging ports.
Deep DivePublic companies must disclose material cyber incidents within four business days. The deadline is simple; deciding what counts as material is not.
An August attack compromised multiple VMware ESXi nodes at hosting provider HostDZire, encrypting virtual disks beyond recovery across India, the Netherlands and the US.
Adversary-in-the-middle phishing now defeats standard MFA at industrial scale. Microsoft tracked a single April 2026 campaign spanning 26 countries in 72 hours.