ALL POSTS

Key Findings Cisco patched four critical vulnerabilities in Identity Services Engine and Webex with CVSS scores ranging from 9.8 to 9.9 CVE-2026-20184 allows unauthenticated attackers to impersonate any Webex user through improper certificate validation CVE-2026-20147, CVE-2026-20180, and CVE-2026-20186 enable authenticated attackers with admin credentials to execute arbitrary code and OS commands No evidence of active exploitation in the wild, but immediate patching is stron

Key Findings Microsoft released 165-167 critical and important security updates in April 2026, marking one of the largest Patch Tuesday releases on record Eight vulnerabilities marked critical, including remote code execution flaws in Windows TCP/IP, IKE, Active Directory, and multiple Office applications CVE-2026-32201 SharePoint spoofing vulnerability already exploited in the wild, enabling phishing and social engineering attacks CVE-2026-33825 BlueHammer Windows Defender p

Key Findings Eight validated attack vectors discovered across AWS Bedrock environments, spanning log manipulation, knowledge base compromise, agent hijacking, flow injection, guardrail degradation, and prompt poisoning Attack chains begin with low-level permissions and escalate to reach critical enterprise assets including Salesforce, SharePoint, Active Directory, and databases Knowledge bases and agents represent the highest-value targets due to their direct connectivity to

Key Findings CISA added five critical vulnerabilities to its Known Exploited Vulnerabilities catalog, including three Apple flaws, one Craft CMS code injection, and one Laravel Livewire vulnerability Three Apple vulnerabilities are linked to active exploitation by the DarkSword iOS exploit kit Craft CMS flaws have been actively exploited in the wild to breach servers and steal data Laravel Livewire vulnerability is associated with Iran-nexus APT group MuddyWater Federal agenc

Key Findings CISA added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog Vulnerabilities affect Microsoft SharePoint and Zimbra Collaboration Suite Federal agencies required to patch these vulnerabilities by specific deadlines One vulnerability allows remote code execution, the other enables cross-site scripting Background The U.S. Cybersecurity and Infrastructure Security Agency (CISA) continues its proactive approach to identifying and addressing

Key Findings * RondoDox botnet targeting 174 different vulnerabilities between May 2025 and February 2026 * Daily exploit attempts peaked at 49, stabilized around 40, then sharply declined in early 2026 * Nearly half of exploited flaws used only once, indicating rapid testing and selection * Quickly adopts newly disclosed vulnerabilities, sometimes within weeks * Targets diverse device types including routers, DVRs, NVRs, CCTV systems, and web servers * Demonstrates inconsist

Key Findings Microsoft released patches for 84 new security vulnerabilities affecting various software components 8 vulnerabilities are rated Critical, and 76 are rated Important in severity 46 of the patched vulnerabilities relate to privilege escalation, followed by 18 remote code execution, 10 information disclosure, 4 spoofing, 4 denial-of-service, and 2 security feature bypass flaws 2 publicly disclosed zero-days are included: CVE-2026-26127 (CVSS 7.5) - Denial-of-servic

Key Findings Microsoft released its monthly security update for March 2026, addressing 79 vulnerabilities 3 vulnerabilities were marked as "critical" by Microsoft Remaining vulnerabilities were classified as "important" Microsoft assessed that exploitation of the "critical" vulnerabilities is "less likely" Background CVE-2026-26110 and CVE-2026-26113 are "critical" Microsoft Office Remote Code Execution Vulnerabilities CVE-2026-26144 is a "critical" information disclosure vul

Key Findings: Attackers are exploiting vulnerabilities or weak credentials in FortiGate Next-Generation Firewall (NGFW) devices to gain initial access to corporate networks. Once inside, the attackers extract configuration files containing service account credentials and information about the internal network structure. The campaign appears to target sectors such as healthcare, government agencies, and managed service providers. Attackers have abused features like Single Sign

Key Findings: Iran-linked hackers targeted IP cameras across Israel and several Gulf countries, including the UAE, Qatar, Bahrain, and Kuwait, as well as Lebanon and Cyprus. The goal appears to be reconnaissance and real-time monitoring to support intelligence gathering and potential military targeting. Threat actors targeted vulnerabilities in Hikvision and Dahua IP cameras, such as improper authentication, command injection, and remote code execution flaws. Scanning and exp

Key Findings The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-22719 (CVSS 8.1) - Broadcom VMware Aria Operations Command Injection Vulnerability CVE-2026-21385 (CVSS 7.8) - Qualcomm Multiple Chipsets Memory Corruption Vulnerability Background The Broadcom vulnerability is a command injection flaw that allows an unauthenticated attacker to execute arbitrary commands, po

Key Findings: A Russian-speaking threat actor compromised over 600 FortiGate firewalls across 55 countries in just 5 weeks The attacker systematically used generative AI and large language models (LLMs) to write tools and plan follow-on actions inside victim networks The campaign did not rely on zero-day vulnerabilities, instead targeting publicly accessible admin panels and VPN portals protected by weak credentials Stolen FortiGate configurations provided detailed informatio

Key Findings SolarWinds has patched four critical vulnerabilities in its Serv-U file transfer server software The flaws could allow remote code execution and give attackers full root access on unpatched systems The vulnerabilities include: CVE-2025-40538: Broken access control flaw allowing creation of admin user and arbitrary code execution as root CVE-2025-40539 and CVE-2025-40540: Type confusion vulnerabilities enabling arbitrary native code execution as root CVE-2025-4054

Key Findings Researchers executed 27 successful attacks against industry-leading password managers Bitwarden, LastPass, and Dashlane Attacks show how compromised servers and design flaws can expose encrypted vault data 1Password emerged as the most secure option due to its use of a Secret Key Background We often treat cloud-based password managers as digital safes that only we can open. These services rely on Zero-Knowledge Encryption, a marketing promise that the company sto

Key Findings: CISA has added two actively exploited vulnerabilities in Roundcube webmail software to its Known Exploited Vulnerabilities (KEV) catalog. The vulnerabilities are CVE-2025-49113 (CVSS 9.9) and CVE-2025-68461 (CVSS 7.2). CVE-2025-49113 is a deserialization of untrusted data flaw that allows remote code execution by authenticated users. CVE-2025-68461 is a cross-site scripting vulnerability in the "animate" tag of an SVG document. Attackers have already weaponized

Key Findings A Russian-speaking, financially motivated threat actor has compromised over 600 FortiGate devices located in 55 countries between January 11 and February 18, 2026. The threat actor leveraged multiple commercial generative AI tools to automate various stages of the attack cycle, including tool development, attack planning, and command generation. No exploitation of FortiGate vulnerabilities was observed - the campaign succeeded by exploiting exposed management por

Key Findings The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a vulnerability in BeyondTrust Remote Support (RS) and older Privileged Remote Access (PRA) products to its Known Exploited Vulnerabilities (KEV) catalog. The flaw, tracked as CVE-2026-1731, has a CVSS score of 9.9 and could allow an unauthenticated attacker to execute remote commands without logging in. BeyondTrust released security updates on February 6, 2026, to address the critical vulnera

Key Findings Apple has fixed an actively exploited zero-day vulnerability in its ecosystem, including iOS, macOS, and other devices. The vulnerability, tracked as CVE-2026-20700, is a memory corruption flaw in Apple's Dynamic Link Editor (dyld) that allows attackers to execute arbitrary code. The flaw was discovered and reported by Google's Threat Analysis Group, suggesting it may have been used in sophisticated, targeted attacks by nation-state actors or commercial spyware v

Key Findings Microsoft released security updates to address 59 vulnerabilities, including 6 that are actively being exploited in the wild. Of the 59 flaws, 5 are rated Critical, 52 are rated Important, and 2 are rated Moderate in severity. 25 of the patched vulnerabilities are privilege escalation, followed by remote code execution (12), spoofing (7), information disclosure (6), security feature bypass (5), denial-of-service (3), and cross-site scripting (1). The 6 actively e

Key Findings Microsoft released security updates to address 58 new vulnerabilities across Windows, Office, Azure, Edge, Exchange, Hyper-V, and other components. The update includes fixes for 6 zero-day vulnerabilities that are being actively exploited in the wild. 5 of the vulnerabilities were rated as "Critical" by Microsoft. Several vulnerabilities affect high-profile targets like GitHub Copilot, IDEs, and Azure cloud services. Background This month's Patch Tuesday from Mic