Blog · Topic
Threat Intelligence
Threat actor analysis, malware writeups, IOC reporting, CTI from a defender perspective.
20 articles
ConnectWise ScreenConnect: Critical SCKit Malware Campaign Exploits CVE-2026-84869
A critical vulnerability, CVE-2026-84869, in ConnectWise ScreenConnect client is being actively exploited by SCKit malware, posing a severe threat. Patch immediately to version 26.6.5 or later and secure operator sessions.
N-able N-central Zero-Days: Immediate Action Required
N-able has patched critical zero-day vulnerabilities in its N-central RMM platform, some of which are being actively exploited in the wild. SMBs using N-central must update immediately to version 2026.4 HF2 to mitigate risk.
Exploited Outlook Zero-Day: CVE-2026-124194 Security Advisory
Microsoft has patched an actively exploited Outlook zero-day, CVE-2026-124194. This spoofing vulnerability could lead to the disclosure of user authentication information (NTLMv2 hash) by tricking a user into opening a malicious file.
SonicWall SonicOS MFA Bypass Flaw (CVE-2026-19868) and Other High-Severity Vulnerabilities
CISA has flagged a critical SonicWall SonicOS MFA bypass vulnerability, CVE-2026-19868, as actively exploited. VITI Security advises immediate action for affected SMBs to patch their systems and review their security posture.
Barracuda Email Security Gateway: Critical Root Access Vulnerabilities (CVE-2026-116606, CVE-2026-111560)
Two critical vulnerabilities in Barracuda Email Security Gateway appliances allow unauthenticated root access without a login. VITI Security advises immediate patching to protect your business's vital email infrastructure.
Apple CVE-2024-27834 and CVE-2025-43529 Zero-Days Under Active Attack
CISA warns that Apple vulnerabilities CVE-2024-27834 and CVE-2025-43529 are being actively exploited by threat actors to deliver info-stealing malware. Learn what systems are affected and how to patch immediately.
Android SMS of Death Exploit (CVE-2026-58882) Advisory
A proof-of-concept exploit for the "SMS of Death" vulnerability (CVE-2026-58882) targeting Android devices has been publicly released. Unpatched Android 12 and 13 phones are at risk of remote crashes and service disruption. Update your devices immediately.
Ivanti Connect Secure Exploit Chain: CVE-2026-104935, CVE-2026-111357, and CVE-2026-118527 Advisory
A threat actor dubbed UTA0576 is chaining three Ivanti Connect Secure vulnerabilities to gain unauthenticated root access. Learn if you are affected and how to patch now.
Immediate Action Required: Critical Drupal Commerce Core Flaw (CVE-2026-118539) Under Active Attack
A critical access bypass vulnerability (CVE-2026-118539) in Drupal's Commerce Core module is being actively exploited in the wild. All businesses running affected versions must patch immediately and audit their systems for financial inconsistencies.
CISA Adds GitLab RCE and Cisco Firewall DoS Vulnerabilities to KEV Catalog
CISA has added critical GitLab and Cisco vulnerabilities to the Known Exploited Vulnerabilities catalog. Learn if you are affected and how to respond.
VMware ESX Zero-Day: China-Linked APT Exploits CVE-2026-41709 to Hide Traces
A critical zero-day vulnerability (CVE-2026-41709) in VMware ESX is being actively exploited by a China-linked threat actor to bypass logging. Small and mid-sized businesses running affected VMware products must patch immediately.
PHP2Shell Critical RCE Vulnerabilities CVE-2026-109618 and CVE-2026-109619 Exploited
Two critical remote code execution (RCE) vulnerabilities, collectively known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), are now actively exploited in the wild. If your business runs PHP versions 8.2.* before 8.2.35, 8.3.* before 8.3.36, 8.4.* before 8.4.27, or 8.5.* before 8.5.12, immediate patching is required.
When Legitimate Drivers Go Rogue: Defending Against EDR Evasion
The recent Lunex Stealer campaign, leveraging legitimate AMD drivers to disable EDR, highlights a critical shift in attacker tactics. We need to evolve our defenses beyond signature-based detection and focus on deeper system integrity.
Closing the Exploitability Gap: Validating CVEs Before Attackers Do
It's no longer enough for a scanner to flag a CVE. We need to actively prove if a vulnerability is truly exploitable in our environment before an attacker beats us to it.
CISA Flags Exploited Flaws: Why Your SMB Needs to Patch Now
CISA recently added critical Cisco, Citrix, and Fortinet flaws to its Known Exploited Vulnerabilities catalog. This isn't just a federal mandate; it's a clear signal that these vulnerabilities are actively being weaponized, and every SMB needs to act immediately.
When Your Firewall's Brain is Vulnerable: Lessons from CVE-2026-20079
A critical authentication bypass in Cisco's Secure Firewall Management Center (FMC) is being actively exploited, highlighting the severe risk of vulnerabilities in core security infrastructure. This incident underscores the urgent need for robust management plane security and proactive patching.
Zero-Click Attacks on Mobile Apps: Defending Against Autonomous Worms
A recent zero-click WeChat worm demonstrates how autonomous mobile malware bypasses user interaction. Here is how practitioners should evaluate mobile risk.
Browser Extensions: A Post-Compromise Persistence Nightmare
Compromised browser extensions like PEEP are not just annoyances; they're stealthy backdoors for command execution and data exfiltration after an initial breach. Securing your endpoints requires a layered approach, focusing on robust EDR, strict application control, and proactive browser management.
Invisible Phishing: Re-calibrating Your Email Gateway Defenses
A new high-volume phishing campaign leverages invisible Unicode characters to bypass email filters. This means standard regex-based content scanning is falling short, requiring a shift to advanced normalization and behavioral analysis at the gateway.
