Threat actors, campaigns and techniques.
Brief2 min read
Richard Horne's annual report warning points at unpatched, long-tolerated vulnerabilities rather than novel AI attacks, and sets out a £70 million vulnerability centre and £60 million for Cyber Shield.
ExploitedCVE-2026-111497CVSS 9.21 min read
Check Point Research says the Brotli decompression bug, first tied to Node.js, may also reach Python packages, .NET and proxies, and that scanning and exploitation attempts are already showing up.
Brief1 min read
Researchers describe government and cloud-service impersonation in an espionage campaign targeting Israel and the Kurdistan Region of Iraq.
Brief1 min read
Cisco Talos describes a Windows infostealer that adds model-driven analysis to stolen credentials, sessions and other information collected from a victim.
Brief1 min read
Kaspersky describes a previously undocumented loading framework found in an intrusion involving a Windows build customized for government use in Asia.
Brief2 min read
CrowdStrike attributes a campaign across 14 countries to a China-nexus group that ran an open-source multi-agent penetration-testing framework, with at least nine organisations compromised.
Brief1 min read
Unit 42 describes persistent access, credential theft and suspected AI-assisted scripting in a campaign against government infrastructure.
Brief2 min read
Two recipients have gone public: a Turkey-based reporter and a Lebanese documentary filmmaker who says Pegasus hit his phone in 2017 and 2021.
Brief2 min read
The kit skips password-harvesting pages entirely, walking victims through Microsoft's own Device Login portal with a code the attacker supplied.
Brief1 min read
Talos says attackers used a critical Cisco Catalyst SD-WAN flaw, fixed in February, to plant custom malware that copies site-to-site encryption keys. The vendor calls the attacks historical but gives no timeline.
ExploitedCVE-2026-20127CVSS 10.01 min read
Researchers say UAT-11473 used an authentication-bypass flaw Cisco patched in February 2026 to plant a framework that intercepts control-plane traffic and lifts keying material.
ExploitedCVE-2026-20127CVSS 10.02 min read
Talos says UAT-11473 used a critical Cisco SD-WAN flaw to plant the KeyDrift framework on controllers. Lumen's Black Lotus Labs published research the same day on the Silent Train network.
