Disclosed flaws, patches and exploitation status.
Warlock ransomware attackers exploit Microsoft SharePoint vulnerabilities to gain initial access, disable security tools and distribute ransomware across critical infrastructure networks.
A public PoC for Apple CoreGraphics CVE-2026-86950 demonstrates memory corruption through a malicious PDF, while new WhatsApp PDF protections raise questions about a possible delivery path.
Kiteworks patched a previously unknown critical vulnerability discovered during a nine-hour precautionary shutdown prompted by intelligence about a potential cyberattack, with no evidence of exploitation.
TeamFiltration attackers targeted over 5,700 Microsoft 365 accounts across 28 tenants, compromising seven unmanaged service accounts using default or unrotated passwords without MFA.
Attackers are actively exploiting WordPress CVE-2026-87902, a critical CVSS 9.2 flaw that enables unauthenticated local PHP file inclusion and conditional remote code execution.
A leaked GitLab incoming email address can let attackers impersonate users, push code to permitted branches and trigger CI/CD pipelines without passing normal 2FA or IP restrictions.
MikroTrick chains CVE-2026-67279 and CVE-2026-86060 to let attackers take full control of internet-exposed MikroTik RouterOS devices without a password or SSH key.
cPanel patches CVE-2026-87899, a serious CalDAV/CardDAV flaw that allows an authenticated hosting account to execute code as root and potentially take full control of a shared server.
F5 patches CVE-2026-94127, a critical CVSS 9.8 BIG-IP APM zero-day actively exploited to achieve unauthenticated remote code execution on OAuth authorization servers.
China-linked UTA0565 exploited Chrome and Windows zero-days through fake websites to deploy CLEANGULP, a new backdoor supporting commands, file theft and BOF execution.
Critical Next.js vulnerability CVE-2026-94545, rated CVSS 9.5, could allow unauthenticated remote code execution through crafted input passed to Node.js ImageResponse.
This week's cybersecurity recap covers an exploited Cisco ISE zero-day, AI-agent RCE risks, surging ClickFix attacks, ChainScript malware, browser hijacking and software supply-chain threats.
One brief each morning: the advisories that matter, the noise removed.
Double opt-in. One-click unsubscribe in every email. We never sell addresses.
Subscribe for walkthroughs and security tips.