Every incident, CVE and outage below was read the same way: what actually happened, why the architecture allowed it, and the change that would have stopped it. 133 briefs, written for the people who have to act on them.
Palo Alto Networks Unit 42 published the investigation on September 2, 2026: a human attacker who handed tactical execution to frontier AI models running inside attack-specific…
Read the brief
It shipped an abstraction — and abstractions are where blast radius hides. September 2, 2026: Equinix announced Fabric One, a managed any-to-any connectivity service across…
Read the brief
CVE-2026-20212 — CVSS 9.8 — unauthenticated remote code execution as root on Cisco Nexus 9000 Series switches built on the Silicon One ASIC. Disclosed September 2, 2026…
Read the brief
McKesson has confirmed a data breach. ShinyHunters claims 284 million records and has demanded $55,236,150, with a 72-hour clock that expired around September 1, 2026. WHAT…
Read the brief
Not a lab any more. Production — and under active exploitation. September 2, 2026: seven vulnerabilities added to the Known Exploited Vulnerabilities catalog. Two of them sit in…
Read the brief
CVE-2026-60004 — critical code injection in Gitea, CVSS 9.8. CISA added it to the KEV catalog on August 25 after confirmed exploitation in the wild. More than 8,300…
Read the brief
August 21, 2026: Arelion — a global Tier 1 backbone — went down for 1 hour 21 minutes across a 3 hour 10 minute window, disrupting customers in more than 30 countries. Four days…
Read the brief
CVE-2026-60004 — critical code injection in Gitea, CVSS 9.8. CISA added it to the KEV catalog on August 25 after confirmed exploitation in the wild. Over 8,300 internet-exposed…
Read the brief
CVE-2026-8452 — Citrix NetScaler ADC and Gateway. CISA added it to the KEV catalog on August 26 with a three-day federal deadline. It is being exploited right now. WHAT ACTUALLY…
Read the brief
August 26, 2026 KEV additions: CVE-2015-3246 , CVE-2015-5287 , CVE-2019-1068 , CVE-2021-23758 , CVE-2022-0995 — and one 2026 flaw. Eleven years of backlog, all being exploited…
Read the brief
and there is no patch for you to install. CVE-2026-69836 , disclosed by Microsoft on August 20: unauthenticated RCE in Entra ID via deserialization of untrusted data. Already…
Read the brief
On August 20, 2026, the DOJ unsealed a 14-count superseding indictment charging 17 Iranian nationals from the Tehran-based Mabna Institute with running intrusions since at least…
Read the brief
Not in a router. In the software that manages your routers. Nine flaws across Cisco Crosswork and Cisco Secure Workload, published 19 August 2026. Five scored a perfect 10.0 — the…
Read the brief
CVE-2026-72529 and CVE-2026-72530 — two actively exploited flaws in TrueConf Server. CISA added both to the KEV catalog on August 20 with a three-day patch deadline. Kaspersky…
Read the brief
CVE-2026-73570 — CVSS 8.9 — unauthenticated command execution through Zimbra Collaboration's SNMP monitoring function. CERT Polska reported active exploitation on August 17.…
Read the brief
CVE-2026-8037 — CVSS 9.6 — unauthenticated command injection in Progress Kemp LoadMaster. Hundreds of exploit attempts from dozens of IP addresses across multiple countries before…
Read the brief
Cisco's IOS XE Software Security Hardening Release, published August 5, 2026, covers CVE-2026-20267 through CVE-2026-20273 in IOS XE and Catalyst SD-WAN. Cisco found them…
Read the brief
CVE-2026-64849 — CVSS 9.3 — unauthenticated SSRF in MLflow, the tracking server sitting at the centre of most enterprise ML pipelines. Assigned August 17. Exploited the same day.…
Read the brief
Lazarus Group exploited CVE-2026-68820 — a use-after-free in afd.sys, the driver behind Windows Sockets — against defense, aerospace and aviation targets across Europe and India.…
Read the brief
It just needs to be rebooted — remotely, unauthenticated, on repeat. CVE-2026-20349 is an actively exploited flaw in the VPN web server of Cisco Secure Firewall ASA and FTD. CVSS…
Read the brief
NIS2 compliance obligations culminate in an October 2026 deadline across 18 critical sectors, and DORA has entered its first real supervisory enforcement cycle for financial…
Read the brief
800G Ethernet has moved from hyperscaler-only to enterprise reality, driven entirely by on-premises AI. IEEE 802.3dj standardization is expected to complete in 2026, with early…
Read the brief
The Model Context Protocol has become one of the fastest-weaponized attack surfaces in enterprise IT. The specification defines OAuth 2.1 authorization — and explicitly marks it…
Read the brief
CVE-2026-18577 is an authentication bypass in N-able N-central — the platform MSPs and IT teams use to centrally administer servers, workstations and network devices. CVSS 8.2,…
Read the brief
A threat actor calling himself "TheHatman" is selling internal directory data allegedly pulled from the Azure/Entra tenants of Fortune 500 organizations — McDonald's (~1.7M…
Read the brief
Microsoft's August 2026 release addressed over 400 vulnerabilities — 42 rated Critical, 37 of those remote code execution — with CVE-2026-68820 confirmed exploited in the wild…
Read the brief
On August 18, the FBI, CISA and HHS published an updated #StopRansomware advisory: Medusa has now impacted more than 500 victims across critical infrastructure — up from 300 in…
Read the brief
countries. CVE-2026-59310 — a CVSS 9.8 directory traversal in VMware vCenter — went from public disclosure to global exploitation by a suspected China-nexus APT in under a week.…
Read the brief
Lazarus Group spent roughly five weeks exploiting CVE-2026-68820 — a use-after-free in afd.sys, the driver behind Windows Sockets — against defense, aerospace and aviation targets…
Read the brief
CVE-2026-20349 — CVSS 8.6 — a single crafted HTTP request reloads Cisco Secure Firewall ASA and FTD appliances. Cisco published the advisory on August 11, 2026, already aware of…
Read the brief
Authentication is not the first thing an attacker reaches — the handshake is. CVE-2026-33824 — CVSS 9.8 — a double free in the Windows IKE Service Extensions. Microsoft patched it…
Read the brief
GeoServer jsonArrayContains — CVSS 9.8, unauthenticated SQL injection, no CVE number, exploitation attempts within hours of a public tweet. The fixed versions landed Friday. Your…
Read the brief
CVE-2026-59309 — CVSS 9.8 — an authentication bypass in VMware Directory Service, the identity layer behind vCenter Single Sign-On. Disclosed by Broadcom in VMSA-2026-0006. No…
Read the brief
CVSS 10.0. Unauthenticated SQL injection in Metabase, the open-source BI platform thousands of teams use to query their data warehouses. No CVE identifier was ever assigned — so…
Read the brief
not just patient records, the actual software and firmware behind it. The Everest ransomware group says it exfiltrated 1 TB of data, more than 682,887 files, from Omnicell, the…
Read the brief
CVE-2026-9198 — CVSS 9.8 — Langflow code injection — added to CISA's Known Exploited Vulnerabilities catalog on August 4, 2026, with a public proof-of-concept already circulating.…
Read the brief
team touches every day — within 48 hours of each other. CVE-2026-63077 (TeamCity, CVSS 9.8), CVE-2026-59309 /59310 (vCenter, CVSS 9.8), and CVE-2026-66066 (Rails Active Storage,…
Read the brief
The AI agent took it from there — no human clicked another button for the rest of the operation. Unit 42 tracked "knaithe" (aka KnYuan), a Zhuhai-based operator who wired DeepSeek…
Read the brief
And a Cisco Catalyst 9300 switch stops passing traffic entirely — no crash, no reboot, no alarm. CVE-2026-20114 and CVE-2026-20110 , uncovered by Opswat's Unit 515 Critical…
Read the brief
Moody Bible Institute disclosed that ShinyHunters compromised 2.3 million records — donor financial details, student records, and decades of alumni data — and leaked them. The…
Read the brief
Meta's three flagship platforms failed together, in the same afternoon window, for the second time this week. Users worldwide got logged out, saw "account temporarily…
Read the brief
On July 17, 2026, Acosol — the public water utility serving Spain's western Costa del Sol — confirmed a ransomware attack by the Qilin group. This is not a hypothetical about…
Read the brief
Nokia just turned it into an AI inference platform — and that changes what "network capacity" means. On July 15, Nokia unveiled the industry's first commercial AI-RAN platform,…
Read the brief
no click, no approval dialog, no warning. If the repo has a file named git.exe sitting in its root, Cursor just ran it as you. A zero-day in Cursor's Windows Git path resolution…
Read the brief
SonicWall confirmed active exploitation this week — and patching alone will not evict the attacker. CVE-2026-15409 (CVSS 10.0) — unauthenticated SSRF in the SMA1000 Work Place…
Read the brief
The patch has existed since May. Exploitation started in July anyway. CVE-2026-46817 — CVSS 9.8 — improper privilege management in the File Transmission component of Oracle…
Read the brief
AssuranceAmerica detected the intrusion in one day. The public found out 115 days later. AssuranceAmerica, an Atlanta-based auto insurer working through 9,500+ independent agents…
Read the brief
The company confirmed the breach and called it "isolated." It did not say what was actually taken. Accenture, July 6 — a threat actor using the handle "888" claimed to have stolen…
Read the brief
Conduent didn't get hacked five more times. It just took that long to find out how big the first one was. Conduent Business Services, a back-office vendor serving hundreds of…
Read the brief
Cloudflare's public DNS resolver suffered a global outage on July 14. Within minutes, monitoring tools showed Tata Communications (AS4755) announcing Cloudflare's 1.1.1.0/24…
Read the brief
It works against both Intel and AMD. CVE-2026-53359 — "Januscape." A use-after-free in the shadow MMU code that KVM shares across x86 vendors, letting a malicious guest VM with…
Read the brief
CVE-2008-4128 — cross-site request forgery flaws in the HTTP administration interface of Cisco IOS 12.4, originally disclosed in 2008. On July 13, CISA added it to the Known…
Read the brief
July 2026 Patch Tuesday: 59 critical, 510 important, 3 zero-days — two actively exploited before the patch existed, one publicly disclosed ahead of a fix. If your patch window is…
Read the brief
Your patch window closed before most teams finished reading the advisory. CVE-2026-48282 — Adobe ColdFusion, CVSS 10.0, maximum severity. A path traversal flaw in the Remote…
Read the brief
New BGP attribute parsing vulnerabilities are hitting the wire in 2026, and testing shows they don't affect every router equally. Juniper Junos OS, Nokia SR-OS, Extreme EXOS,…
Read the brief
That's all it takes to write root-level files onto the platform managing your entire SD-WAN fabric. CVE-2026-20262 — CVSS 6.5 — arbitrary file write in Cisco Catalyst SD-WAN…
Read the brief
Researchers at Sysdig have documented JadePuffer, what appears to be the first fully autonomous ransomware operation. Reconnaissance, credential theft, lateral movement,…
Read the brief
CVE-2026-0625 — CVSS 9.3 — arbitrary shell command execution on discontinued D-Link DSL gateway devices, actively exploited through a compromised CGI library. VulnCheck confirmed…
Read the brief
CVE-2026-48558 in SimpleHelp's remote monitoring and management platform scores a perfect 10. The TaskWeaver loader is already being deployed through it. If your MSP uses…
Read the brief
Researchers at Sysdig have documented JadePuffer, what appears to be the first fully autonomous ransomware operation. Reconnaissance, credential theft, lateral movement,…
Read the brief
CVE-2026-45659 — CVSS 8.8 — SharePoint Server remote code execution via deserialization of untrusted data — just landed on CISA's Known Exploited Vulnerabilities catalog. The…
Read the brief
The FortiBleed credential-theft campaign has now been linked directly to the INC and Lynx ransomware operations. This was never a smash-and-grab. It was reconnaissance at…
Read the brief
By the time most tickets reach a human in 2026, the fix will already be deployed. That is the direction Tier 1 and Tier 2 network operations are heading. Not "AI-assisted." Not…
Read the brief
CVE-2026-45659 — a remote code execution vulnerability in SharePoint Server — was just added to CISA's Known Exploited Vulnerabilities catalog. Translation: this isn't theoretical…
Read the brief
The cybercrime ecosystem is becoming increasingly industrialized, and a recent discovery underscores this evolution more clearly than ever. Since April 2026, a stealthy new…
Read the brief
Novee Security just uncovered a critical CI/CD vulnerability — codenamed Cordyceps — giving attackers full control over repositories at Microsoft, Google, Apache, and Cloudflare.…
Read the brief
8 gigabytes of sensitive data left your network last quarter. Not through HTTP. Not through email. Not through VPN. Through DNS queries. Each query carried 63 bytes of encoded…
Read the brief
8 gigabytes of sensitive data left your network last quarter. Not through HTTP. Not through email. Not through VPN. Through DNS queries. Each query carried 63 bytes of encoded…
Read the brief
Russian-speaking threat actors already inside enterprise perimeters worldwide. This is FortiBleed. An active campaign that has already breached tens of thousands of network…
Read the brief
June 2026 Patch Tuesday is not routine maintenance. It is the most consequential patch cycle in Microsoft's history. 208 CVEs. 33 critical. Two of them require your immediate…
Read the brief
June 2026 confirmed what security teams have warned for years: ransomware has moved beyond data theft. Three attacks in one month — three sectors — one objective: disrupt…
Read the brief
In cybersecurity, we focus on external actors — APTs, ransomware, supply chain attacks. We build firewalls, deploy zero-trust, and harden endpoints. The DOGE/SSA case exposes a…
Read the brief
For the first time in history, a criminal threat actor used artificial intelligence to develop a zero-day exploit. This isn't a prediction or a war game scenario. It happened —…
Read the brief
For years, the debate was theoretical. In 2026, it's a budget line item. Enterprise networks built on hybrid WAN architectures — MPLS cores with SD-WAN overlays — are being…
Read the brief
On May 18, CERT-FR issued 16 critical security alerts in a single day — a remarkable and unprecedented concentration of simultaneous threat activity. Official data confirms a…
Read the brief
Canadian federal authorities have arrested a 23-year-old Ottawa man in connection with "Kimwolf," a Mirai-variant botnet that infected approximately 2 million IoT devices…
Read the brief
Law enforcement just delivered a direct message to every cybercriminal relying on bulletproof infrastructure. In a coordinated action, Europol and Eurojust dismantled First VPN —…
Read the brief
The results are in. Pwn2Own Berlin 2026 has wrapped up, and the numbers deserve serious attention. 47 zero-day vulnerabilities successfully demonstrated. $1,298,250 paid out to…
Read the brief
If you have not patched yet, you are exposed right now. CVE-2026-40361 — CVSS 9.8 — is a remote code execution vulnerability requiring zero user interaction. No click. No macro.…
Read the brief
Here is what happened — and what it means for your organization. In April 2026, 7-Eleven confirmed a significant data breach after the ShinyHunters extortion gang gained…
Read the brief
On May 20, 2026, U.S. and Canadian authorities announced the arrest of Jacob Butler, a 23-year-old Ottawa resident known online as "Dort," suspected of building and operating…
Read the brief
CVE-2026-73570 — CVSS 8.9 — unauthenticated command execution through Zimbra Collaboration's SNMP monitoring function. CERT Polska reported active exploitation on August 17.…
Read the brief
without realizing the program goes much further, and that levels five through eight certify entirely different roles. A certification is a commitment. Choosing the wrong level…
Read the brief
Most engineers default to PCNSE — without realizing there are distinct tracks built for different roles. A certification is a commitment. Choosing the wrong one costs twelve to…
Read the brief
not because they lack knowledge, but because they don't understand what each track actually certifies. A certification is a commitment. Choosing the wrong one costs twelve to…
Read the brief
The GPU was built for graphics. It became the most powerful password cracking tool ever created. It is also one of the least monitored components in your security stack. WHY IT…
Read the brief
Most network engineers start the same way. A static route here. Another one there. It works — until the network grows and the routing table becomes a full-time maintenance job.…
Read the brief
In 2026, relying solely on signature-based detection is like playing chess blindfolded — you're always one move behind, and your opponent knows it. The threat landscape has…
Read the brief
Every security engineer has an opinion. Most are wrong about the tradeoffs. The right OS is not the most popular one. It is the one built for the threat model you are actually…
Read the brief
In 2026, Fortinet, Palo Alto Networks, and Cisco have embedded generative AI into the core of their SASE platforms. The result is not smarter dashboards. It is autonomous policy…
Read the brief
Starting July 2026, Microsoft will permanently block TLS 1.0 and TLS 1.1 connections for POP3 and IMAP4 protocols on Exchange Online. No exceptions. No extensions. If your mail…
Read the brief
Most engineers treat it as a minor version bump. It isn't. TLS 1.3 is a fundamental redesign of how secure connections are established — and the gap between the two protocols is…
Read the brief
This is a question most network engineers never ask — until it's too late. IPSec is the backbone of enterprise VPN security. But there's a critical configuration decision hiding…
Read the brief
For: Abstraction Has Redefined Security Priorities The cloud has transformed how infrastructure is built and secured. Platforms like AWS, Azure, and Google Cloud abstract away the…
Read the brief
You did not authorize it. Spanning Tree Protocol has no authentication. Any device on your segment can send a BPDU and reshape your topology. If its priority is low enough, it…
Read the brief
Not because monitoring caught it. Because a user complained about slowness. The logs existed. The anomaly was there. No one was watching. NETWORK VISIBILITY FOR SME INFRASTRUCTURE…
Read the brief
The cause: Spanning Tree Protocol with no Root Bridge defined. STP saves you from broadcast storms. Wrong configuration makes it the source of one. WHAT STP DOES AND WHY IT BREAKS…
Read the brief
It's "admin". Or "password". Or just nothing at all. And it's sitting right now on a router, a switch, a camera, or a firewall somewhere in your company's network — completely…
Read the brief
Private 5G networks are no longer a concept — they're being deployed right now across manufacturing floors, hospital campuses, seaports, and smart warehouses. And most security…
Read the brief
Wi-Fi 7 deployments are accelerating. Faster throughput, lower latency, better spectrum efficiency. The promise is real. So are the new risks. 802.11be introduces capabilities…
Read the brief
Wi-Fi 7 deployments are accelerating. Faster throughput, lower latency, better spectrum efficiency. The promise is real. So are the new risks. 802.11be introduces capabilities…
Read the brief
Attackers no longer break in — they log in. And once inside, they move quietly, blend with legitimate traffic, and exploit the one blind spot most security stacks still can't…
Read the brief
SASE is no longer a buzzword. It is the dominant architecture for hybrid organizations. But most deployments still fail for the same reason. Organizations buy SASE products before…
Read the brief
Not because engineers don't know BGP. Because the design decisions that prevent failures are invisible — until it all goes down at 2 AM. Four pillars. One resilient design. 1.…
Read the brief
For years, cybersecurity operated like a divided house. On one side: the Red Team — ethical hackers, penetration testers, adversary simulators. Their job? Break things. Find the…
Read the brief
For decades, network engineering relied on manual CLI commands, undocumented changes, and "if it works, don't touch it" culture. That era is over. NetDevOps — the convergence of…
Read the brief
One of those responses might not be from your DHCP server. A rogue DHCP server needs no exploit. It just needs to reply faster than yours. What DHCP does: When a device connects,…
Read the brief
Attackers built entire toolkits around this single design flaw. Dynamic ARP Inspection (DAI) and IP Source Guard close the gap. Together with DHCP Snooping, they complete the…
Read the brief
Network segmentation is one of the most cited controls in modern architecture. It is also one of the most consistently misconfigured. The same switches that segment your network…
Read the brief
83% of network outages are caused by human configuration errors. Yet most organizations still manage their networks through CLI sessions and tribal knowledge locked in individual…
Read the brief
CIS Cisco IOS benchmark has 87 controls. The average enterprise enforces fewer than 30. What an unprotected management plane looks like TELNET STILL ENABLED Telnet transmits…
Read the brief
You normalized a 29-day exposure window. Attackers measured it. They built tooling around it. Average time to patch critical vulnerabilities: 60 days. Average time to exploitation…
Read the brief
67% of enterprises that deployed SD-WAN created direct internet breakouts at branch sites without rebuilding security controls first. The perimeter did not disappear. It…
Read the brief
DNS-based attacks account for 88% of all malware command-and-control activity. You are watching the wrong protocol. What DNS does: The Domain Name System translates human-readable…
Read the brief
DNS-based attacks account for 88% of all malware command-and-control activity. You are watching the wrong protocol. What DNS does: The Domain Name System translates human-readable…
Read the brief
VPN technology was designed in the 1990s to extend a trusted perimeter to remote users. The core assumption: your network is safe, outside users need access, bring them inside. In…
Read the brief
It also gives your analysts dangerous confidence in wrong answers. The case for AI-assisted defense is real. The risks of deploying it without discipline are underestimated. What…
Read the brief
OT/ICS cyberattacks with physical consequences increased 355% between 2020 and 2025. The battlefield has changed. What is OT/ICS: Operational Technology and Industrial Control…
Read the brief
OT/ICS cyberattacks with physical consequences increased 355% between 2020 and 2025. The battlefield has changed. What is OT/ICS: Operational Technology and Industrial Control…
Read the brief
Your developers are building autonomous workflows. Your security team has no idea. This is the defining security challenge of 2026. Unlike a chatbot that answers questions, an AI…
Read the brief
In 2026, enterprise networks are no longer managed by humans alone. Agentic AI systems now handle Tier 1 and Tier 2 network operations autonomously. Incident detection, root cause…
Read the brief
Securing Your Network Most cyberattacks exploit poorly configured or under-protected network infrastructure. Choosing the right equipment is not enough. You need to know how to…
Read the brief
approved by their IT department. Most of them see no problem with this. This is Shadow AI, and it is the fastest-growing data leakage vector in enterprise security today. The…
Read the brief
5.5 billion smartphones worldwide. 85% of employees use personal devices for work. 47% of organizations have experienced mobile security incidents. The BYOD revolution has created…
Read the brief
The cost of fixing a security vulnerability increases exponentially Design: 100 USD — Development: 1,500 USD — Testing: 10,000 USD — Production: 150,000 USD The financial case for…
Read the brief
Security teams are drowning in alerts. The average SOC analyst receives 4,500 alerts per day. 67% are false positives. Manual triage and response is impossible at this scale.…
Read the brief
Modern applications run on APIs. They connect services, power mobile experiences, and enable integrations. They are also massively insecure. 90% of APIs have critical…
Read the brief
But adversaries are stealing your encrypted data today, storing it, and waiting for quantum capabilities to decrypt it. This is "harvest now, decrypt later" and it represents an…
Read the brief
In 2025, 62% of data breaches originated from compromised third-party suppliers. That number is projected to reach 75% by the end of 2026. The attack surface is no longer just…
Read the brief
But adversaries are stealing your encrypted data today, storing it, and waiting for quantum capabilities to decrypt it. This is "harvest now, decrypt later" and it represents an…
Read the brief
60% of data breaches involve insider access, either malicious or negligent. Your greatest security risk is not external hackers. It is your own employees, contractors, and…
Read the brief
95% of cloud security failures are caused by customer misconfigurations, not provider vulnerabilities. Your cloud infrastructure is secure. Your implementation of it is not. This…
Read the briefNo brief matches that search.
