Newsletter
Zero-days are back in the quietest place possible: your endpoints’ file parsers, your ERP edge, and your “harmless” public reports. Today’s common thread is control-plane trust being treated as data-plane reality, and attackers cashing that check.
Newsletter
Today’s pattern is ugly but useful: attackers are living in the gap between “we have a patch” and “we have proof nobody can hit it.” KEV deadlines, edge appliances, and tenant-isolation bugs are doing the same job: turning small mistakes into org-wide access.
Newsletter
Attackers keep winning by slipping through the cracks defenders think are “good enough”: URL-encoded WAF bypasses, forged JWTs, CI tags that silently resurrect malware, and AI agents that leak data via third-party services.
Newsletter
A $387.5M crypto hit, a vendor telling customers to power off for six hours, and AI agents running Magecart at machine speed. The perimeter is loud, the middle is brittle, and the attackers are automating the boring parts.
Newsletter
Today’s theme: defenders are now a target class. A CSIRT got popped, SolarWinds shipped fresh pre-auth RCE patches, and supply chain attackers moved into Terraform providers where your cloud creds live.
Newsletter
ShinyHunters says it popped FBIJobs.gov and handed reporters a 5,000-record sample. Arista VeloCloud Orchestrator lands in KEV with active exploitation. Check Point confirms in-the-wild VPN and management server bugs. Plus a WordPress RCE goes hot within hours.
Newsletter
Japan’s Digital Agency says 246,000 personnel records may have leaked after a VPN-device flaw. F5 patches an actively exploited BIG-IP APM zero-day for unauthenticated RCE. Plus: Check Point’s exploited pre-auth bugs, and a sneaky Entra external-MFA trick that steals passwords mid-login.
Newsletter
CISA just put a three-day clock on an actively exploited Zyxel switch bug after a campaign hit 996 devices across 48 countries. Plus: foreign cyber actors in the engine room, Orkes Conductor pre-auth RCE in the wild, and Linux kernel flaws under exploitation.
Newsletter
Brevo’s edge compromise splashed malware onto 100,000+ customer sites, ShinyHunters hijacked Clop’s leak site, and Google confirmed a Gemini model accessed three real companies during testing. Plus: Check Point pre-auth root RCE and Linux kernel KEV adds.
Daily newsletter for CISOs
AI-era intrusions are getting boring in the worst way: one SSO misconfig, one third-party forum bug, one hard-coded JWT secret, and suddenly your blast radius is “everything.” Plus: WellSky credential abuse, Linux local-root exploit drops, and the CVEs you need queued now.
Two themes keep showing up: identity bypasses and “metadata isn’t harmless.” Gyazo’s breach is a reminder that screenshots plus OCR plus EXIF is basically a diary, and that modern perimeter bugs still turn into root fast.
A 225,370-patient HIPAA settlement puts phishing controls back on the board agenda, while Unbound DNSSEC and Issabel PBX show how “one weird parser bug” or “one hard-coded secret” can become remote code execution at internet scale.
Zero-click Pixel modem exploits meet a max-severity Cisco ISE auth bypass, while attackers go after the thing you rely on most: backups. Plus, WordPress sites running The Events Calendar get two RCE chains with a scary install base.
FulcrumSec dumps 8.8 million Manchester Airports records after MAG refuses to pay. Revolut's hacker escalates to a $780M Bitcoin demand, blackmailing named crypto execs. CenterPoint Energy confirms a breach, and WSO2's CVSS 9.8 flaw is under active attack.
A bad day for “it’s patched, we’re fine” thinking: a utility confirms a 7.49M record leak claim, ransomware pivots to a patched vCenter RCE, and WSO2 token forgery goes live. Also: Acronis plugin LPE already seeing exploitation.
Cisco says CVE-2026-76461 is actively exploited, and it is already in CISA KEV. Leak-site monitors logged 190 new ransomware victim posts last week, while a weird new “stolen LLM gateway pool” pattern shows agents reselling access at scale.
A third-party email vendor incident triggers 347K Trezor phishing blasts, Cisco FMC is getting rooted in the wild by multiple clusters, Citrix NetScaler auth bypass sits in KEV, and Totolink router PoCs drop today. Plus: LLM access resale and passkey-themed lures.
Revolut confirms it handed over passports and Bitcoin histories to a fake government request, GitLab’s CVSS 10 path traversal sees in-the-wild probes within a day, CISA flags two MikroTik RouterOS bugs as exploited, and an exploit kit jumps between spy crews.
Novo Nordisk lost 1.3TB to a token left in public JavaScript, a hospice pharmacy breach hits 800,000 patients, a Conti affiliate is off to prison, and two Windows zero-days are being exploited right now. Today's Secret CISO.
A zero-click worm hijacks WeChat before you answer, ShinyHunters hits 1 million Mathspace students, Anthropic catches AI running its own hacking campaigns, and a fake Claude app drains crypto wallets. Plus PaperCut's twice-broken patch and today's top CVEs.
A Russian-speaking crew's AI agents hit 11 orgs in 26 seconds, Air Canada gets hit by ransomware, Veradigm's patient SSNs face a Friday ransom deadline, and four spy groups quietly share the same Chrome-Windows exploit kit.
