2026-03-26 20:46 UTC
Other
Other
P5
LATEST
Aggregated cybersecurity reporting, advisories and research. 1,456 matching records.
AUTO-POLL // 2026-10-10 12:35 UTC
CYBER INTEL TEMPERATURE
TODAY'S AGGREGATED INTELLIGENCE
COOL
COOL
WARM
ELEVATED
HOT
CRITICAL
P2 / P100
7-DAY C.I.T. REPORT
CYBER CONDITIONS // DAILY C.I.T. READINGS
TODAY → 6 DAYS AGO
TODAY
Oct 10
RANSOMWARE
P2
COOL // 7 ARTICLES
FRI
Oct 9
RANSOMWARE
P4
COOL // 67 ARTICLES
THU
Oct 8
RANSOMWARE
P3
COOL // 62 ARTICLES
WED
Oct 7
RANSOMWARE
P5
COOL // 86 ARTICLES
TUE
Oct 6
RANSOMWARE
P3
COOL // 61 ARTICLES
MON
Oct 5
RANSOMWARE
P5
COOL // 48 ARTICLES
SUN
Oct 4
RANSOMWARE
P10
WARM // 11 ARTICLES
2026-03-25 07:51 UTC
Government
Government
2026-004: Critical Vulnerability in SharePoint Exploited
On 17 March 2026, Microsoft updated one of its January 2026 security advisories related to a remote code execution vulnerability in Microsoft SharePoint. Specifically, Microsoft raised the CVSS score and changed the FAQ section to indicate that the vulnerability could be exploited by an unauthenticated attacker. This vulnerability was added in the CISA's Known Exploited Vulnerabilities (KEV) catalogue on 18 March 2026. Additionally, three further RCE flaws affecting Microsoft SharePoint were ad…
P55
2026-03-18 07:04 UTC
Other
Other
AI Exposure and CTEM: The Next Frontier of External Risk
Prepared by: Sudhanshu Chauhan 🔗 (Director, RedHunt Labs) and Devang Solanki 🔗 (Security Researcher, RedHunt Labs) There is a loop in cybersecurity. A new technology enters the enterprise. Adoption moves faster than governance. Security teams hear about it during incident response instead of during planning. And the exposure window, that gap between deployment and visibility, gets exploited before anyone realizes it even existed. We saw it with open cloud storage buckets. We saw it with expos…
P15
2026-02-26 18:38 UTC
Government
Government
2026-002: Multiple Vulnerabilities in Cisco Products
On 25 February 2026, Cisco released security advisories addressing multiple high and critical severity vulnerabilities in Cisco Catalyst SD-WAN controllers and Cisco SD-WAN Manager. If exploited, these vulnerabilities could allow attackers to gain administrative access to compromised systems. It is recommended to capture forensic evidence, hunt for indicators of compromise, and apply updates as soon as possible. One of the vulnerabilities, CVE-2026-20127, is exploited in the wild since 2023.
P25
2026-02-25 00:00 UTC
Government
Government
[MàJ] Vulnérabilité dans Cisco Catalyst SD-WAN (25 février 2026)
Une vulnérabilité a été découverte dans Cisco Catalyst SD-WAN. Elle permet à un attaquant de provoquer un contournement de la politique de sécurité. Cisco indique que la vulnérabilité CVE-2026-20127 est activement exploitée.
P5
2026-02-08 06:00 UTC
Security Journalism
Security Journalism
Active Exploitation of SolarWinds Web Help Desk (CVE-2025-26399)
Huntress has observed active exploitation of a deserialization and remote code execution against the SolarWinds Web Help Desk software (CVE-2025-26399).
P20
2026-02-06 16:22 UTC
Other
Other
P5
2026-01-30 09:09 UTC
Government
Government
2026-001: Critical vulnerabilities in Ivanti EPMM
On 29 January 2026, Ivanti released a security advisory addressing two critical vulnerabilities in their EPMM products. An attacker could exploit those flaws to achieve unauthenticated remote code execution on the vulnerable device. One of these vulnerabilities have been exploited in a limited number of cases.
P15
2026-01-22 15:00 UTC
Security Journalism
Security Journalism
Huntress Catches SmarterMail Account Takeover Leading to RCE
SmarterMail versions prior to Build 9511 are vulnerable to privileged account takeover and remote code execution. Learn more about the latest Huntress DE&TH Team’s findings.
P15
2026-01-07 14:00 UTC
Security Journalism
Security Journalism
ESXi Exploitation in the Wild
Huntress outlines a complex, multi-step attack designed to break out of guest VMs and target the ESXi hypervisor, using potential zero-day vulnerabilities and sneaky VSOCK communication.
P45
2025-12-22 09:55 UTC
Other
Other
Revisiting CVE-2025-50165: A critical flaw in Windows Imaging Component
A comprehensive analysis and assessment of a critical severity vulnerability with low likelihood of mass exploitation
P35
2025-12-18 23:00 UTC
Security Journalism
Security Journalism
Gladinet CentreStack/Triofox: Cryptography Vulnerability | Huntress
Threat actors are exploiting a vulnerability in Gladinet’s CentreStack and Triofox products that stems from hardcoded cryptographic keys in the AES implementation.
P0
2025-12-18 09:08 UTC
Government
Government
2025-042: Critical Vulnerability in Cisco Secure Email and Web Manager
On December 17, 2025, Cisco released a security advisory for a critical vulnerability affecting Cisco Secure Email Gateway and Cisco Secure Email and Web Manager products. It is recommended to follow Cisco's recommendations to check whether vulnerable appliances have been compromised, and to remediate the issue. There is no patch available for this vulnerability yet.
P10
2025-12-10 05:00 UTC
Security Journalism
Security Journalism
PeerBlight Linux Backdoor Exploits React2Shell CVE-2025-55182
Huntress is seeing threat actors exploit React2Shell (CVE-2025-55182) to deploy a Linux backdoor, a reverse proxy tunnel, and a Go-based post-exploitation implant.
P5
2025-12-05 00:00 UTC
Government
Government
[MàJ] Vulnérabilité dans React Server Components (05 décembre 2025)
**[Mise à jour du 11 décembre 2025]** Le CERT-FR a connaissance de multiples exploitations de la vulnérabilité CVE-2025-55182. Les serveurs avec une version vulnérable exposés après la publication des preuves de concept publiques du 5 décembre 2025 doivent être considérés comme compromis....
P5
2025-11-13 16:59 UTC
Vendor Research
Vendor Research
Rust in Android: move fast and fix things
Posted by Jeff Vander Stoep, Android Last year, we wrote about why a memory safety strategy that focuses on vulnerability prevention in new code quickly yields durable and compounding gains. This year we look at how this approach isn’t just fixing things, but helping us move faster. The 2025 data continues to validate the approach, with memory safety vulnerabilities falling below 20% of total vulnerabilities for the first time. Updated data for 2025. This data covers first-party and third-party…
P25
2025-11-03 16:46 UTC
Other
Other
CVE-2025-12463— 9.8 Unauthenticated SQL Injection in Guetebruck G-Cam Series Cameras
Smile, you’re on camera.
P5
2025-10-24 04:00 UTC
Security Journalism
Security Journalism
Exploitation of Windows Server Update Services Remote Code | Huntress
Huntress has observed threat actors exploiting a Microsoft Windows Server Update Services (WSUS) vulnerability (CVE-2025-59287).
P5
2025-10-15 04:00 UTC
Security Journalism
Security Journalism
Active Exploitation of Gladinet CentreStack and Triofox | Huntress
Huntress has observed in-the-wild exploitation of a Local File Inclusion vulnerability in Gladinet CentreStack and Triofox products.
P0
2025-10-06 08:11 UTC
Other
Other
From Cost Center to ROI Engine: Making ASM a Security Investment That Pays for Itself
In today’s sprawling digital landscape, the question for security leaders isn’t whether Attack Surface Management (ASM) matters; it’s whether your ASM platform is doing enough to earn its place in the budget. If your board or finance team is asking you to justify the spend, you’re not alone. Saying it “improves visibility” or “reduces risk” isn’t enough anymore. You need to show real outcomes, saved hours, reduced incidents, lower cloud costs, and stronger operational resilience. That’s where C…
P0
2025-09-17 00:00 UTC
Other
Other
Entra ID actor token validation bug allowing cross-tenant global admin
A critical vulnerability discovered in Microsoft's Entra ID (formerly Azure AD) allowed for cross-tenant access and potential global admin privilege escalation. The flaw was found in the legacy Azure AD Graph API, which improperly validated the originating tenant for undocumented "Actor tokens." An attacker could use a token from their own tenant to authenticate as any user, including Global Admins, in any other tenant. This vulnerability bypassed security policies like Conditional Access. The …
P10
2025-09-15 17:01 UTC
Vendor Research
Vendor Research
Supporting Rowhammer research to protect the DRAM ecosystem
Posted by Daniel MoghimiRowhammer is a complex class of vulnerabilities across the industry. It is a hardware vulnerability in DRAM where repeatedly accessing a row of memory can cause bit flips in adjacent rows, leading to data corruption. This can be exploited by attackers to gain unauthorized access to data, escalate privileges, or cause denial of service. Hardware vendors have deployed various mitigations, such as ECC and Target Row Refresh (TRR) for DDR5 memory, to mitigate Rowhammer and e…
P10
2025-09-15 05:44 UTC
Other
Other
Agneyastra to the Rescue: Protecting your Firebase Projects before the Tea spills out!
In July 2025, the Tea app 🔗, a mental health and social community platform, experienced a devastating breach that spilled 72,000 images (including 13,000 driver’s license and verification selfies) and over 1.1 million private direct messages onto the internet. The leaks first surfaced on 4chan and quickly spread across forums, torrents, and underground channels. This was not “just another API key leak.” Instead, it was a story about Firebase misconfigurations, poor data retention practices, an…
P25
2025-09-09 14:50 UTC
Other
Other
P5
2025-08-26 00:00 UTC
Government
Government
Vulnérabilité dans Citrix NetScaler ADC et NetScaler Gateway (26 août 2025)
Le 26 août 2025, Citrix a publié un bulletin de sécurité (cf. section Documentation) concernant, entre autres, la vulnérabilité CVE-2025-7775. Celle-ci permet une exécution de code arbitraire à distance et affecte toutes les versions de Citrix NetScaler ADC et NetScaler Gateway, dans certaines...
P5
2025-08-21 00:00 UTC
Other
Other
Dataform cross-tenant path traversal
Dataform could have allowed a malicious customer to gain unauthorized cross-tenant access to other customer's code repositories and data. By preparing a maliciously crafted package.json file, an attacker could exploit a path traversal vulnerability in the npm package installation process, thereby gaining read and write access in other customers' repositories. According to Google, there was no evidence of exploitation in the wild.
P20
2025-08-14 00:00 UTC
Other
Other
AWS ECS Agent Information Disclosure Vulnerability
A vulnerability in the Amazon ECS agent could allow an introspection server to be accessed off-host. This information disclosure issue, if exploited, could allow another instance in the same security group to access the server's data. The vulnerability does not affect instances where off-host access is set to 'false'. The issue has been patched in version 1.97.1 of the ECS agent.
P0
2025-08-13 22:00 UTC
Security Journalism
Security Journalism
Active Exploitation of SonicWall VPNs
A likely zero-day vulnerability in SonicWall VPNs is being actively exploited to bypass MFA and deploy ransomware. Huntress advises disabling the VPN service immediately or severely restricting access via IP allow-listing. We're seeing threat actors pivot directly to domain controllers within hours of the initial breach.
P40
2025-08-12 16:00 UTC
Vendor Research
Vendor Research
Android’s pKVM Becomes First Globally Certified Software to Achieve Prestigious SESIP Level 5 Security Certification
Posted by Dave Kleidermacher, VP Engineering, Android Security & Privacy Today marks a watershed moment and new benchmark for open-source security and the future of consumer electronics. Google is proud to announce that protected KVM (pKVM), the hypervisor that powers the Android Virtualization Framework, has officially achieved SESIP Level 5 certification. This makes pKVM the first software security system designed for large-scale deployment in consumer electronics to meet this assurance bar. …
P0
2025-08-05 00:00 UTC
Government
Government
Incidents de sécurité dans les pare-feux SonicWall (05 août 2025)
[Mise à jour du 7 août 2025] Le 6 août 2025, SonicWall a remplacé une partie de son communiqué initial pour indiquer que les incidents de sécurité évoqués étaient vraisemblablement corrélés à la vulnérabilité CVE-2024-40766. Celle-ci a fait l'objet d'un bulletin de sécurité, SNWLID-2024-0015 (cf....
P5