The latest critical vulnerabilities, ransomware campaigns, malware and nation-state activity — the threats security teams need to know about now.
Everest claims 812 GB from the Brenner Base Tunnel project, but unverified extortion claims demand scrutiny. The real …
Security Affairs' Round 122 newsletter highlights a convergence of supply-chain attacks, backdoored admin panels, and APT campaigns targeting …
SonicOS firewalls running SAML-based SSL-VPN authentication are exposed to an actively exploited MFA bypass (CVE-2026-19868) and six other …
A multi-year campaign distributing malicious repositories disguised as legitimate security tools has compromised over 2,000 Windows systems. The pivot from crypto-targeting to cybersecurity professionals signals a dangerous evolution …
Attackers are actively exploiting the Plex2Shell vulnerability chain against QNAP NAS devices exposed to the internet. Patching alone is insufficient — QNAP itself recommends treating devices as compromised …
A paradox in WordPress's update mechanism means installing the fix for CVE-2026-119977 can momentarily expose sites to the very flaw it patches. Defenders must block wp-content/upgrade access before …
Veeam is navigating dual operational threats: a critical Linux kernel RCE (CVE-2026-98432) affecting MPTCP and an availability bug causing kernel panics on AMD EPYC hosts due to FIPS …
CVE-2026-123158 lets attackers bypass authentication on password-disabled accounts in OpenSSH on musl-based systems. Exploitation was observed within 9 hours of disclosure. Alpine Linux default configs are directly in …
D-Link has disclosed multiple unpatched zero-day vulnerabilities in DGS-3130 series enterprise switches, with no CVEs assigned yet. Attackers on the local network can extract credentials, alter configurations, and …
Microsoft patched an 8.1-CVSS RCE in Paint, but the fix ships through Store updates — not Windows Update. Worse, conflicting version data between the advisory and CVE record …
CISA's addition of CVE-2026-19868 to the KEV Catalog places SonicWall SonicOS SSLVPN single-factor authentication weaknesses squarely in the crosshairs. With active exploitation confirmed, SSLVPN appliances that lack MFA …
The UK's grave risk warning for critical infrastructure underscores a systemic failure: OT/IT convergence has outpaced defensive capabilities. Shield53 examines what defenders should prioritize now, from segmentation to …
QiAnXin's XLab uncovered a backdoor implanted directly into the Control Web Panel web server binary — one that hides its traffic from access logs and manipulates file timestamps …
Russia's coordinated influence campaigns in Latin America demonstrate how AI-generated forgeries and front organizations are being weaponized to destabilize democracies. Shield53 analyzes the tradecraft and what defenders must …
A sophisticated phishing campaign abusing AI hype combines device code phishing and adversary-in-the-middle proxying to steal Microsoft and Google session tokens. The dual-kit approach renders traditional MFA insufficient …
Truffle Security's revocation program exposes a hard truth: 81% of leaked keys remain valid six months after disclosure. With 16 issuers now bypassing unresponsive developers to revoke directly, …
Russia's Cozy Bear is expanding beyond traditional desktop endpoints to mobile platforms via watering hole attacks. The shift reflects a broader trend: nation-state actors are adapting to mobile-first …
The '*sshole' flaw exploits a semantic collision between OpenSSH's timing-attack mitigations and musl's crypt() behavior, allowing oversized passwords to bypass disabled-account locks. Alpine Linux cloud images on AWS …
A critical OpenSSH flaw on Alpine Linux lets attackers bypass authentication for passwordless accounts using oversized passwords. Shield53 breaks down the musl-specific root cause and what defenders must …
CWPdoor replaces legitimate cwpsrv binaries with a cryptographically authenticated backdoor that hides in plain sight on Linux hosting panels. With 340,000+ exposed CWP instances, defenders must rethink integrity …
AI tools are shrinking the zero-day-to-n-day window for defenders, but network appliances remain unpatched for over a year on average. This divergence creates a rapidly expanding attack surface …
A multi-agency US government advisory warns that threat actors are actively targeting industrial refrigeration and cold chain monitoring systems. Attackers can force heating cycles, destroy inventory, and create …
October 2026's active threat campaigns share a common DNA: weaponizing trusted platforms and legitimate workflows. SkyW4lker's device-code phishing and similar attacks expose why perimeter defenses are failing and …
APT29's latest watering hole campaign demonstrates a troubling convergence of supply-chain compromise and precision mobile targeting. By poisoning a Ukrainian analytics service and cloning high-profile sites, the SVR-linked …
Bitdefender's GhostMap disclosure reveals a zero-permission Android denial-of-service flaw that bricks devices in a boot loop — and Google's refusal to patch it sets a dangerous precedent for …
Zyxel's Patch 2 for CVE-2026-7273 failed to fully close the original exploit path, requiring a new CVE (CVE-2026-107441) and Patch 3 firmware. With 996 switches confirmed compromised and …
The extradition of a Canadian national for hijacking academic supercomputers highlights persistent gaps in higher-ed cybersecurity. Shield53 analysts unpack the cryptojacking playbook and what institutions must do now.
A critical vulnerability in Rails Active Storage's ImageMagick integration allows attackers to write arbitrary files and read sensitive data through crafted image uploads, potentially enabling lateral movement and …
Zyxel's CVE-2026-107441 went undetected for months because defenders assumed June patches stopped Kapibala's attacks. Nearly 1,000 switches were compromised due to incomplete validation fixes that attackers bypassed.
DreamHost's disclosure that attackers maintained access to its File Manager for two months highlights a broader failure: plaintext credential storage in web infrastructure. The real risk isn't just …
A critical APT vulnerability (CVE-2026-109518) allows man-in-the-middle attackers to swap verified packages with malicious ones executing as root. Shield53 analyzes the supply chain implications and remediation priorities.
The tampering of Level Infinite's CDN-hosted launcher scripts for over a month before detection highlights persistent gaps in game-industry supply-chain integrity. The credential and crypto-wallet theft capabilities signal …
Google's disruption of a 1.3 million-device botnet allegedly built by Android manufacturer Videostrong represents a worst-case supply chain scenario — the vendor itself was the threat actor. Defenders …
SonicWall's disclosure of two unpatched vulnerabilities in end-of-life Global Management System software underscores a persistent enterprise risk: management consoles that outlive their support lifecycles become prime attack surfaces. …
APT29's supply chain compromise of Plerdy SEO Tracker demonstrates how a single poisoned JavaScript file can become a precision delivery mechanism for mobile espionage — targeting iOS and …
CISA has confirmed active exploitation of a WordPress Core TOCTOU race condition vulnerability. With Wordfence reporting over 13,000 attack attempts in 24 hours, organizations running WordPress must patch …
A critical Rails Active Storage vulnerability allows unauthenticated attackers to write and read arbitrary server files via ImageMagick's MSL coder, potentially exposing secret_key_base and enabling RCE. Organizations on …
Two Xen hypervisor flaws (CVE-2026-102703, CVE-2026-102704) break fundamental VM isolation, letting a malicious guest read/write any other VM's memory including dom0. Every Xen deployment from 4.6 onward is …
Google's November 2026 Android security bulletin patches 216 vulnerabilities including a zero-click RCE in media decoding components. Shield53 breaks down why FrameDecoder.cpp flaw CVE-2026-58868 stands out and what …
APT29 weaponizes patched iOS and Android vulnerabilities in zero-click watering hole attacks, harvesting messaging databases and credentials. The real failure isn't the exploits—it's that organizations still treat mobile …
Russia's rare arrest of three VasyGrek members signals a shift in domestic cybercrime enforcement. The group's decade-long phishing-to-theft campaign relied on commodity malware and legitimate remote access tools …
Attackers weaponized cPGuard's own autoupdate CDN to push backdoored versions, stealing root credentials, SSH keys, and database configs from ~2,946 servers. The breach highlights why update infrastructure is …
North Korean APT operatives weaponized the job interview process to deliver undetected macOS malware to a Binance engineer, ultimately enabling a $6.3 billion theft. The attack highlights how …
The FBI attributes the October 2026 Binance theft to TraderTraitor (Lazarus Group), using fake job interviews, tampered Homebrew packages, and internal AI tool abuse. The attack chain reveals …
Chainstack's breach disclosure reveals AI-powered autonomous agents are now conducting end-to-end offensive operations against infrastructure providers. The dev-to-prod escalation and exposure of password hashes and node credentials mark …
Synology's October 2026 ransomware disclosure highlights a persistent industry problem: edge devices patched in 2024 are still being encrypted in 2026. The most likely vector, CVE-2024-10441 (CVSS 9.8), …
OPSSHIELD's cPGuard update infrastructure was hijacked via stolen credentials, pushing backdoored versions 5.88.12–5.88.19 to customer Linux servers. The incident exposes a painful irony and a broader industry blind …
Two CVEs affecting six Barracuda product lines could chain together to grant attackers root on security appliances. With a history of nation-state exploitation targeting these exact devices, organizations …
Evidence that a 3AM ransomware affiliate may have used AI to generate and revise attack commands signals a turning point. Defenders must prepare for adversaries who adapt in …
Bitdefender's forensic analysis of a 3AM ransomware hit on a UK school estate reveals command patterns consistent with AI agentic loops. Defenders must now account for threat actors …
CISA disclosed two critical vulnerabilities in Subnet Solutions PowerSYSTEM Center affecting energy and critical manufacturing deployments worldwide. The combination of authorization bypass and SQL injection creates a chained …
CISA added CVE-2026-119977, a WordPress Core TOCTOU race condition, to its KEV Catalog with evidence of active exploitation. Organizations running WordPress should treat this as an immediate priority …
Gartner's exposure prioritization framework validates what defenders have suspected: fewer than 10% of CVEs get exploited, yet most are treated as urgent. Risk-based prioritization combining threat intel, asset …
Russia-aligned Gorbag (UAC-0226) is weaponizing CVE-2025-8088 in WinRAR to deploy stealers like GIFTEDCROOK and BeautyStealer against Ukrainian law enforcement and defense targets—likely as an initial access broker feeding …
Google's takedown of a 1.3M-device botnet reveals a chilling supply chain reality: the device manufacturer itself was the adversary. Shield53 analyzes the XCPE backdoor's enterprise implications and what …
Attackers are actively stealing Bitcoin and Litecoin from BTCPay Server instances running versions prior to 2.4.2 by exploiting a credential access flaw. Shield53 analyzes the attack chain and …
Threat actors are actively exploiting a patched Synology DSM vulnerability to deploy C3RB3R ransomware. The critical CVE-2024-10441 flaw (CVSS 9.8) enables remote code execution on unpatched NAS devices …
Apple's spyware notifications to German Bundestag members underscore the persistent threat commercial surveillance vendors pose to democratic institutions. The BSI's guidance to assume compromise is the correct posture …
A CVSS 10.0 flaw in Siemens SIMATIC IoT2050 devices is being actively exploited to deploy botnet malware and persistent backdoors. Industrial operators running Node-RED on unpatched devices face …
CVE-2026-81648 in the CryptoPayment Gateway WordPress plugin is a maximum-severity flaw with active exploitation and no available patch. Defenders must treat this as an emergency deinstallation and key-rotation …