Topics
CVEs, actors, campaigns, incidents, tools, and annual reports tracked across briefs. The badge marks items covered in more than one brief — these are the "stories that unfolded".
- Palo Alto PAN-OS Captive Portal — unauthenticated root RCE (CVSS 9.3, ITW, KEV deadline 2026-05-09)2026-05-082026-05-07
- Instructure (Canvas LMS) data breach — student and educator data2026-05-082026-05-072026-05-06
- Ivanti EPMM on-prem — pre-auth certificate impersonation (CVSS 9.1, ITW, KEV chain with CVE-2026-6973)2026-05-08
- Ivanti EPMM on-prem — admin API improper input validation → RCE (CVSS 7.2, ITW, KEV deadline 2026-05-10)2026-05-08
- Windows Shell protection mechanism failure — NTLM coercion / spoofing (CVSS 4.3, APT28 ITW, KEV deadline 2026-05-12)2026-05-08
- GLPI < 10.0.25 / 11.0.7 — SSRF (CERTFR-2026-AVI-0551)2026-05-08
- GLPI < 10.0.25 / 11.0.7 — data integrity compromise (CERTFR-2026-AVI-0551)2026-05-08
- GLPI < 10.0.25 / 11.0.7 — stored/reflected XSS (CERTFR-2026-AVI-0551)2026-05-08
- GLPI < 10.0.25 / 11.0.7 — XSS (CERTFR-2026-AVI-0551)2026-05-08
- GLPI < 10.0.25 / 11.0.7 — XSS (CERTFR-2026-AVI-0551)2026-05-08
- GLPI < 10.0.25 / 11.0.7 — XSS (CERTFR-2026-AVI-0551)2026-05-08
- GLPI < 10.0.25 / 11.0.7 — security policy bypass / auth bypass (CERTFR-2026-AVI-0551)2026-05-08
- Pro-Russian hacktivist OT intrusion at five Polish water treatment facilities — pump settings modified2026-05-08
- MuddyWater (Iran/MOIS) Chaos ransomware false-flag + Teams credential harvesting — Europe/Middle East2026-05-08
- Die Linke (Germany) — Qilin ransomware, 1.5 TB claimed, DPA notified (April 2026)2026-05-08
- Eurail breach (December 2025) — 308 777 travellers notified April 2026; Dutch DPA and EDPS reviewing delayed notification2026-05-08
- CERT-FR CERTFR-2026-ACT-016 — Agentic AI tool risks: prompt injection, MCP supply chain, sandboxing2026-05-08
- Dragos 2025 OT Cybersecurity Year in Review — Frontlines IR Edition2026-05-08
- Kaspersky Q1 2026 Exploits and Vulnerabilities Report2026-05-08
- Amazon SES abuse for authenticated BEC/phishing (Kaspersky, 2026-05-04)2026-05-08
- Copy Fail — Linux kernel algif_aead LPE (ITW, KEV deadline 2026-05-15)2026-05-072026-05-06
- Apache HTTP Server 2.4.x — mod_proxy_ajp heap buffer overflow (RCE via AJP backend)2026-05-07
- SimpleHelp RMM — missing authorisation privilege escalation (CVSS 9.9, ITW DragonForce/Medusa, KEV deadline 2026-05-08)2026-05-07
- SimpleHelp RMM — path traversal / zip-slip code execution (CVSS 7.2, ITW, KEV deadline 2026-05-08)2026-05-07
- Samsung MagicINFO 9 Server — unauthenticated path traversal / file write (CVSS 9.8, Mirai, KEV deadline 2026-05-08)2026-05-07
- Progress Telerik UI for ASP.NET AJAX — RadFilter deserialization RCE (CVSS 9.8)2026-05-07
- Progress Telerik UI for ASP.NET AJAX — RadAsyncUpload resource exhaustion DoS (CVSS 7.5)2026-05-07
- Zabbix monitoring platform — XSS / data confidentiality flaw (CERT-FR)2026-05-07
- Zabbix monitoring platform — XSS / data confidentiality flaw (CERT-FR)2026-05-07
- Zabbix monitoring platform — XSS / data confidentiality flaw (CERT-FR)2026-05-07
- Metabase Enterprise — serialization import RCE (CVSS 7.2, public PoC)2026-05-07
- France ANTS government identity agency breach — 11.7M citizen records confirmed2026-05-072026-05-06
- DAEMON Tools supply chain compromise — China-nexus QUIC RAT via signed installers2026-05-07
- ChipSoft (Netherlands) healthcare software vendor — Embargo ransomware, 66 Dutch DPA notifications2026-05-07
- Vimeo data breach via Anodot third-party SaaS compromise — 119,200 accounts2026-05-07
- Europol shadow IT systems — decade of unregulated data processing outside EU oversight2026-05-07
- Mandiant M-Trends 2026 — Annual Threat Intelligence Report2026-05-07
- DragonForce — ransomware-as-a-service operator exploiting SimpleHelp RMM2026-05-07
- Embargo — ransomware group; responsible for ChipSoft Netherlands attack2026-05-07
- OceanLotus (APT32) — Vietnam-nexus APT; PyPI supply chain campaign2026-05-07
- CL-STA-1132 — likely state-sponsored exploitation cluster for CVE-2026-0300 (PAN-OS)2026-05-07
- QLNX (Quasar Linux) — developer-targeting Linux RAT with eBPF rootkit and PAM backdoor2026-05-07
- ZiChatBot — OceanLotus PyPI supply chain backdoor using Zulip API C22026-05-07
- Amatera — InstallFix campaign infostealer targeting browser credentials and e-wallets2026-05-07
- InstallFix — malvertising campaign distributing Amatera infostealer via fake AI tool install pages2026-05-07
- cPanel/WHM authentication bypass — mass exploitation ongoing (KEV deadline 2026-05-21)2026-05-06
- Progress MOVEit Automation — unauthenticated auth bypass (CVSS 9.8)2026-05-06
- Progress MOVEit Automation — authenticated privilege escalation (CVSS 8.8)2026-05-06
- Apache HTTP Server 2.4.66 — HTTP/2 double-free RCE (CVSS 8.8)2026-05-06
- Traefik proxy — mTLS bypass via fragmented TLS ClientHello2026-05-06
- ScarCruft (APT37 / Reaper) — North Korea-aligned APT2026-05-06
- BirdCall — ScarCruft Android/Windows backdoor2026-05-06
- ShinyHunters — financially motivated data-theft group2026-05-06
- TeamPCP — threat actor targeting software supply chains2026-05-06
- Mini Shai-Hulud — TeamPCP SAP CAP npm supply-chain worm2026-05-06
- UAT-8302 — China-nexus APT targeting government entities in South America and southeastern Europe2026-05-06
- World Leaks — rebranded Hunters International; data-theft extortion without encryption2026-05-06
- DigiCert support portal compromise — 60 fraudulent EV code-signing certificates2026-05-06
- Trellix source code repository breach2026-05-06
- ADT Inc. cloud environment breach — customer PII (SEC 8-K 2026-04-24)2026-05-06
- Mediaworks Kft (Hungary) — World Leaks data-theft extortion2026-05-06
- Europol IOCTA 2026 — Internet Organised Crime Threat Assessment2026-05-06