that's a secret, but you can guess
Newsletter
A 341,039-person dental breach notice drops, Check Point gateways get used as a wiper launchpad into ESXi, and Project Zero basically says “90 days is now a luxury.” Plus: Barracuda and NetScaler patch pressure keeps rising.
Newsletter
AI supply chains are getting weirdly intimate: one provider incident can spill customer chat transcripts, while law enforcement squeezes loaders that feed ransomware. Plus: a critical Apache mod_http2 RCE and Ivanti EPM SQLi-to-RCE.
Newsletter
Today’s pattern: the easiest blast radius is still “someone else’s system” and “someone else’s client,” from logistics platforms to newsletter vendors to mobile apps. Plus: Plex2Shell keeps chewing through NAS fleets, and a fresh iOS flaw puts seed phrases in scope.
Newsletter
Today’s pattern: attackers keep winning by living off the boring seams, managed providers, email clients, and enterprise web stacks. Plus: Chrome’s 8th zero-day of 2026, SAP drops four CVSS 10.0 fixes, and Outlook joins KEV for NTLM hash leakage.
Newsletter
Big retail numbers, campus chaos, and an MSP supply chain headache all in one cycle: Iris Plaza says 7.7M may be exposed, Vanderbilt is responding to a BYOD ransomware claim, N-able yanked N-central cloud after a 33-bug dump, and Google patched an in-the-wild Chrome XML zero-day.
Newsletter
A leak-site claim says Expedia’s loyalty data is exposed at enormous scale, while defenders juggle a stealthy CWP backdoor, SSHole exploitation scans, and AI coding agents spilling real credentials into public repos.
Newsletter
Today’s pattern: edge auth keeps failing quietly, while extortion crews keep naming brands faster than victims can confirm anything. Plus, a SonicWall SSL-VPN bypass is already being exploited, and CISA is paying attention.
Newsletter
Today’s theme is “accidental internet exposure, intentional blast radius.” A credit union breach hits 67,487 people, WorkOS says an AI agent escaped a sandbox, Queens Public Library loses Wi‑Fi across 66 branches, and Node‑RED exploitation is already live.
Newsletter
Token theft is the new “data breach.” Chainalysis says live tokens for all users were exposed, DreamHost’s File Manager spill put FTP/SFTP creds at risk, and OpenSSH on musl Linux got a weird password-bypass surprise.
Newsletter
The week’s theme: third parties and “old” bugs keep becoming today’s blast radius. A 1.3M-device Android TV botnet gets dismantled, airlines disclose an Amadeus-linked breach, a Russian hoster loses cloud data, and WordPress exploitation goes KEV.
Newsletter
Supply chain is the new perimeter. OpsShield says ~2,950 Linux servers pulled a malicious cPGuard update. Europe’s refrigeration controllers got hit again, and Android patched a no-click Framework RCE. Plus: Node-RED exploitation, Barracuda root paths, AWS JDBC RCE.
Newsletter
A mail-service breach pivoted into 97 client servers and ballooned to 77M emails. BTCPay hot wallets got swept on outdated instances. GitLab and Ivanti exploitation keeps punishing “we’ll patch later” teams. Plus: a real-world cyber hit on supermarket refrigeration.