Entities
114 CVEs, actors, campaigns, incidents, tools, advisories, and reports tracked across briefs. The badge marks items covered in more than one brief — these are the "stories that unfolded".
Total entities
114
6 types
Recent (30 d)
114
entities with new coverage in window
Distinct sources
82
hosts cited at least once
Total appearances
133
brief-section attributions
Co-occurrence links
144
entity ↔ entity in same item
By type
- cve67 (59%)
- incident20 (18%)
- campaign8 (7%)
- actor8 (7%)
- tool7 (6%)
- annual-report4 (4%)
Recent coverage
Aggregate mentions per ISO week, last 1 weeks.
By year
- 20231
- 20243
- 20256
- 202657
- Groupe 3R (Réseau Radiologique Romand) — Akira ransomware, 48 GB claimed, Swiss medical imaging
- Braintrust AI evaluation platform — AWS account breach exposes customer org-level LLM provider keys
- JDownloader official site compromised — Windows/Linux installers swapped for Python RAT (~48 h window)
- Microsoft Semantic Kernel Python SDK — prompt-injection-to-RCE via InMemoryVectorStore filter (CVSS 9.9)
- Microsoft Semantic Kernel .NET SDK — unintended [KernelFunction] on SessionsPythonPlugin Download/UploadFileAsync → sandbox escape (CVSS 9.9)
- PCPJack — modular cloud-credential-theft worm chaining 5 public CVEs; evicts TeamPCP
- Bauman University 'Department No. 4' — leaked GRU cyber-operator training pipeline (joint The Insider / Guardian / Le Monde / Spiegel investigation)
- Beagle backdoor distributed via fake Claude AI site (claude-pro[.]com) — DonutLoader + DLL sideloading on signed G DATA AV updater (Sophos STAC4713)
- ClickFix expands to macOS — Macsync / Shub Stealer / AMOS via Base64 Terminal-paste lures bypass Gatekeeper (Microsoft research)
- DENIC .de DNSSEC outage — technical post-mortem confirms three private keys with keytag 33834, only one DNSKEY published
- cPanel/WHM unsafe symlink handling — chmod abuse on arbitrary files (CVSS 8.8, second emergency TSR)
- Ivanti EPMM remote authenticated → administrative-access via improper access control (CVSS 8.8, May 2026 update)
- Ivanti EPMM unauthenticated arbitrary method invocation (CVSS 7.0, May 2026 update)
- Ivanti EPMM — fourth companion CVE in May 2026 EPMM update (high-severity per BleepingComputer / SecurityWeek)
- Next.js middleware authorisation bypass via crafted header — weaponised by PCPJack worm
- React/Next.js Server Actions deserialisation ("React2Shell") — weaponised by PCPJack worm
- WPVivid Backup unauthenticated file upload — weaponised by PCPJack worm
- W3 Total Cache PHP injection via mfunc comment processor — weaponised by PCPJack worm
- CentOS Web Panel FileManager shell injection — weaponised by PCPJack worm
- Cisco Unity Connection authenticated RCE in management API (CVSS 8.8, NATO NCSC discovery; logged § 7 — dropped from § 2, gate not cleared)
- Cisco Unity Connection unauthenticated SSRF in default-enabled Web Inbox (CVSS 7.2; logged § 7 — dropped from § 2, gate not cleared)
- Copy Fail — Linux kernel algif_aead LPE (ITW, KEV deadline 2026-05-15)
- Palo Alto PAN-OS Captive Portal — unauthenticated root RCE (CVSS 9.3, ITW, KEV deadline 2026-05-09)
- Instructure (Canvas LMS) data breach — student and educator data
- Ivanti EPMM on-prem — pre-auth certificate impersonation (CVSS 9.1, ITW, KEV chain with CVE-2026-6973)
- Ivanti EPMM on-prem — admin API improper input validation → RCE (CVSS 7.2, ITW, KEV deadline 2026-05-10)
- Pro-Russian hacktivist OT intrusion at five Polish water treatment facilities — pump settings modified
- DAEMON Tools Lite supply chain — QUIC RAT, EU governments targeted
- Inditex (Zara) — ShinyHunters third-party analytics breach, 197,400 EU customers
- DENIC .de DNSSEC outage — HSM integration defect, 3.5 h disruption
- PamDOORa — malicious PAM module with credential harvesting and log scrubbing, sold on Rehub
- Dirty Frag — Linux kernel xfrm-ESP page-cache write primitive, LPE (ITW, PoC public)
- Dirty Frag — Linux kernel RxRPC page-cache write primitive, LPE chain (ITW, patch pending)
- LiteLLM Proxy pre-auth SQL injection — all upstream LLM API keys at risk (CVSS 9.3, KEV deadline 2026-05-11)
- SEPPmail Secure Email Gateway — unauthenticated RCE via exposed GINAv2 test endpoints (CVSS 9.3)
- SEPPmail GINAv2 — missing authentication in admin REST API (CVSS 9.3)
- SEPPmail GINAv2 — insecure deserialisation via session cookie → RCE (CVSS 9.2)
- SEPPmail appliance management — LFI and arbitrary file deletion (CVSS 8.8)
- SEPPmail GINAv2 — server-side template injection via Freemarker (CVSS 8.3)
- SEPPmail appliance management — information disclosure (CVSS 6.9)
- Spring Cloud Config Server pre-auth directory traversal (CVSS 9.8)
- Spring Cloud Config Server Google Secrets Manager backend flaw (HIGH)
- Spring Cloud Config Server companion CVE (HIGH)
- Spring Cloud Config Server companion CVE (MEDIUM)
- xrdp pre-authentication stack buffer overflow → RCE
- Ivanti EPMM January 2026 critical — historical precedent cited in 2026-05-09 Ivanti UPDATE
- Ivanti EPMM January 2026 critical companion — historical precedent cited in 2026-05-09 Ivanti UPDATE
- Apache CloudStack post-auth authentication token flaw — dropped from § 3 (gate not cleared)
- cPanel/WHM CVE cluster — dropped from § 3 (embargoed, gate not cleared)
- cPanel/WHM CVE cluster — dropped from § 3 (embargoed, gate not cleared)
- Windows Shell protection mechanism failure — NTLM coercion / spoofing (CVSS 4.3, APT28 ITW, KEV deadline 2026-05-12)
- GLPI < 10.0.25 / 11.0.7 — SSRF (CERTFR-2026-AVI-0551)
- GLPI < 10.0.25 / 11.0.7 — data integrity compromise (CERTFR-2026-AVI-0551)
- GLPI < 10.0.25 / 11.0.7 — stored/reflected XSS (CERTFR-2026-AVI-0551)
- GLPI < 10.0.25 / 11.0.7 — XSS (CERTFR-2026-AVI-0551)
- GLPI < 10.0.25 / 11.0.7 — XSS (CERTFR-2026-AVI-0551)
- GLPI < 10.0.25 / 11.0.7 — XSS (CERTFR-2026-AVI-0551)
- GLPI < 10.0.25 / 11.0.7 — security policy bypass / auth bypass (CERTFR-2026-AVI-0551)
- MuddyWater (Iran/MOIS) Chaos ransomware false-flag + Teams credential harvesting — Europe/Middle East
- Die Linke (Germany) — Qilin ransomware, 1.5 TB claimed, DPA notified (April 2026)
- Eurail breach (December 2025) — 308 777 travellers notified April 2026; Dutch DPA and EDPS reviewing delayed notification
- CERT-FR CERTFR-2026-ACT-016 — Agentic AI tool risks: prompt injection, MCP supply chain, sandboxing
- Dragos 2025 OT Cybersecurity Year in Review — Frontlines IR Edition
- Kaspersky Q1 2026 Exploits and Vulnerabilities Report
- Amazon SES abuse for authenticated BEC/phishing (Kaspersky, 2026-05-04)
- Ivanti EPMM pre-auth API access (2023, exploited by APT29; cited as historical precedent in 2026-05-08 deep dive)
- Ivanti EPMM critical (January 2025, state-actor exploitation; cited as historical precedent in 2026-05-08 deep dive)
- Microsoft Office Protected View bypass — security feature bypass (CVSS 7.8, KEV deadline 2026-02-16 already passed; deferred from §4)
- Microsoft Office Protected View chain CVE (deferred from §4; see CVE-2026-21509 series)
- Microsoft Office Protected View chain CVE (deferred from §4; see CVE-2026-21509 series)
- Apache HTTP Server 2.4.x — mod_proxy_ajp heap buffer overflow (RCE via AJP backend)
- SimpleHelp RMM — missing authorisation privilege escalation (CVSS 9.9, ITW DragonForce/Medusa, KEV deadline 2026-05-08)
- SimpleHelp RMM — path traversal / zip-slip code execution (CVSS 7.2, ITW, KEV deadline 2026-05-08)
- Samsung MagicINFO 9 Server — unauthenticated path traversal / file write (CVSS 9.8, Mirai, KEV deadline 2026-05-08)
- Progress Telerik UI for ASP.NET AJAX — RadFilter deserialization RCE (CVSS 9.8)
- Progress Telerik UI for ASP.NET AJAX — RadAsyncUpload resource exhaustion DoS (CVSS 7.5)
- Zabbix monitoring platform — XSS / data confidentiality flaw (CERT-FR)
- Zabbix monitoring platform — XSS / data confidentiality flaw (CERT-FR)
- Zabbix monitoring platform — XSS / data confidentiality flaw (CERT-FR)
- Metabase Enterprise — serialization import RCE (CVSS 7.2, public PoC)
- France ANTS government identity agency breach — 11.7M citizen records confirmed
- DAEMON Tools supply chain compromise — China-nexus QUIC RAT via signed installers
- ChipSoft (Netherlands) healthcare software vendor — Embargo ransomware, 66 Dutch DPA notifications
- Vimeo data breach via Anodot third-party SaaS compromise — 119,200 accounts
- Europol shadow IT systems — decade of unregulated data processing outside EU oversight
- Mandiant M-Trends 2026 — Annual Threat Intelligence Report
- DragonForce — ransomware-as-a-service operator exploiting SimpleHelp RMM
- Embargo — ransomware group; responsible for ChipSoft Netherlands attack
- OceanLotus (APT32) — Vietnam-nexus APT; PyPI supply chain campaign
- CL-STA-1132 — likely state-sponsored exploitation cluster for CVE-2026-0300 (PAN-OS)
- QLNX (Quasar Linux) — developer-targeting Linux RAT with eBPF rootkit and PAM backdoor
- ZiChatBot — OceanLotus PyPI supply chain backdoor using Zulip API C2
- Amatera — InstallFix campaign infostealer targeting browser credentials and e-wallets
- InstallFix — malvertising campaign distributing Amatera infostealer via fake AI tool install pages
- CVE-2026-29168
- CVE-2026-29169
- cPanel/WHM authentication bypass — mass exploitation ongoing (KEV deadline 2026-05-21)
- Progress MOVEit Automation — unauthenticated auth bypass (CVSS 9.8)
- Progress MOVEit Automation — authenticated privilege escalation (CVSS 8.8)
- Apache HTTP Server 2.4.66 — HTTP/2 double-free RCE (CVSS 8.8)
- Traefik proxy — mTLS bypass via fragmented TLS ClientHello
- ScarCruft (APT37 / Reaper) — North Korea-aligned APT
- BirdCall — ScarCruft Android/Windows backdoor
- ShinyHunters — financially motivated data-theft group
- TeamPCP — threat actor targeting software supply chains
- Mini Shai-Hulud — TeamPCP SAP CAP npm supply-chain worm
- UAT-8302 — China-nexus APT targeting government entities in South America and southeastern Europe
- World Leaks — rebranded Hunters International; data-theft extortion without encryption
- DigiCert support portal compromise — 60 fraudulent EV code-signing certificates
- Trellix source code repository breach
- ADT Inc. cloud environment breach — customer PII (SEC 8-K 2026-04-24)
- Mediaworks Kft (Hungary) — World Leaks data-theft extortion
- Europol IOCTA 2026 — Internet Organised Crime Threat Assessment
- CVE-2026-24072