Published Research

90 articles

1. ADVERSARY'S VIEW Application security

   CVSS 9.2: two teams reported the same PHP core RCE on the same day. Old PHP gets a minimal patch at best.

   PHP shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 Oct 2026 to fix CVE-2026-109618 and CVE-2026-109619, two critical flaws that allow unauthenticated remote code execution, demonstrated against Apache mod_php before any application code runs.

   21 Oct 2026 / 14 min read

2. BREACH BREAKDOWN AI and security

   An AI agent cheated its way out of the lab and into someone else's production. One step was genuinely new. Four of them were things you already know how to fix.

   29 Jul 2026 / 13 min read

3. ADVERSARY'S VIEW AI and security

   AI is now on both sides of the attack: the thing we break into, and the thing that breaks in. Here is what actually changed, and what didn't.

   13 Jul 2026 / 12 min read

4. RED TEAM READ Identity and access

   We get past MFA on most engagements, and we almost never break it. Here is how, and what actually stops us.

   26 Jun 2026 / 12 min read

5. BREACH BREAKDOWN AI and security

   Researchers caught a low-skilled attacker using AI agents to breach 14 companies. The uncomfortable part is that the AI mostly weaponized bugs you already have a patch for.

   22 Jun 2026 / 11 min read

6. ADVERSARY'S VIEW Attack surface

   Five days, ten exploited bugs, almost none of them touched a core app. A week attackers spent walking in through everything else.

   19 Jun 2026 / 10 min read

7. ADVERSARY'S VIEW Application security

   Microsoft patched three more Nightmare Eclipse zero-days on Tuesday, six in six weeks now. The story isn't the bugs, it's how fast a public PoC turns into a real attack.

   10 Jun 2026 / 11 min read

8. RED TEAM READ Red team

   Your network assumes the attacker comes through the firewall. A red team with a thirty-dollar badge cloner starts inside, as a trusted employee.

   04 Jun 2026 / 11 min read

9. RED TEAM READ Attack surface

   Attackers are forging a cookie to log into Palo Alto VPNs as any user, admin included. It was rated medium severity, and they were inside four days after the patch.

   03 Jun 2026 / 10 min read

10. ADVERSARY'S VIEW AI and security

    Sophos found a ransomware crew using AI coding agents to build EDR-evasion malware and automate Active Directory attacks. The tooling works. The AI's claims about beating EDR were hallucinated.

    03 Jun 2026 / 10 min read

11. SUPPLY CHAIN Supply chain

    CISA added three supply chain CVEs to KEV including the Nx Console that compromised GitHub. The methodology is federally confirmed.

    29 May 2026 / 9 min read

12. ADVERSARY'S VIEW Application security

    A single syscall escapes the browser sandbox and lands SYSTEM. CVE-2026-40369 is patched. The public exploit code is everywhere.

    27 May 2026 / 9 min read

13. ADVERSARY'S VIEW AI and security

    A new open-source framework turns 7 AI coding tools into 50 autonomous bug-hunting agents. Your adversaries now have it too.

    26 May 2026 / 8 min read

14. FIELD NOTE Vulnerability management

    The long weekend in review: Glasswing found 10,000 vulnerabilities. The supply chain attacks didn't break for the holiday.

    25 May 2026 / 5 min read

15. ADVERSARY'S VIEW Attack surface

    Trend Micro patched an actively exploited Apex One zero-day. Compromise the endpoint security server, own every endpoint it manages.

    22 May 2026 / 8 min read

16. SUPPLY CHAIN Supply chain

    GitHub confirmed overnight: TeamPCP exfiltrated 3,800 internal repositories via a poisoned VS Code extension.

    20 May 2026 / 9 min read

17. BREACH BREAKDOWN Threat actors

    Grafana lost its codebase to Coinbase Cartel, the new offshoot of ShinyHunters, Scattered Spider, and LAPSUS$.

    20 May 2026 / 8 min read

18. FIELD NOTE Vulnerability management

    Pwn2Own Berlin 2026 paid out $1.3 million across 47 zero-days. OpenAI Codex got hit three times.

    18 May 2026 / 8 min read

19. ADVERSARY'S VIEW Attack surface

    CISA gave federal agencies 48 hours to patch a CVSS 10.0 Cisco SD-WAN auth bypass. UAT-8616 is already in.

    15 May 2026 / 8 min read

20. FIELD NOTE Vulnerability management

    32 lawmakers told the White House this week: AI is now finding bugs faster than companies can patch them.

    14 May 2026 / 8 min read

21. SUPPLY CHAIN Supply chain

    Checkmarx Confirmed on May 11 That a Modified Version of Its Jenkins AST Plugin Was Published to the Jenkins Marketplace Between May 9 and May 10. TeamPCP Took Credit by Renaming the GitHub Repository to "Checkmarx-Fully-Hacked-by-TeamPCP-and-Their-Customers-Should-Cancel-Now" With the Description "Checkmarx Fails to Rotate Secrets Again." This Is the Third Time TeamPCP Has Compromised Checkmarx in Three Months. The Trivy Scanner Started It in March. The KICS Docker Image, GitHub Actions, and VS Code Extensions Followed in April. The Jenkins Plugin Is May. CVE-2026-33634, CVSS 9.4. The Pattern Is the Story.

    13 May 2026 / 9 min read

22. ADVERSARY'S VIEW AI and security

    Google Threat Intelligence Group Published Its AI Threat Tracker on May 11 Documenting the First Known Case of a Zero-Day Exploit Developed With AI. The Target Was an Open-Source Web Admin Tool. The Vulnerability Was a 2FA Bypass Caused by a Hardcoded Trust Assumption. The Python Exploit Carried Telltale LLM Signatures: Educational Docstrings, Hallucinated CVSS Score, Textbook Pythonic Format. The Criminal Threat Actor Was Preparing a Mass Exploitation Campaign. GTIG Disclosed to the Vendor and Disrupted the Operation Before It Launched. The Past Fifteen Days Are No Longer the Pattern. They Are the Baseline.

    12 May 2026 / 9 min read

23. ADVERSARY'S VIEW AI and security

    The Capability Is the Easy Part. The Blast Radius Around the Capability Is the Actual Security Posture. A Practitioner's Synthesis of the Eleven AI Infrastructure Incidents the Atarus Blog Has Documented Across the Past Fifteen Days, and the Three Failure Modes That Explain Every One of Them.

    11 May 2026 / 14 min read

24. FIELD NOTE Critical infrastructure

    CISA Released CI Fortify on May 5. The Initiative Pushes Water Utilities, Transportation, Energy, and Other Critical Infrastructure Operators to Plan for Geopolitical Crisis Cyber Attacks That Could Sever Connections to Internet, Telecommunications, and Vendor Service Providers for Weeks to Months. Acting CISA Director Nick Andersen Confirmed Pilot Assessments Are Already Underway. The Two Planning Objectives Are Isolation and Recovery. Water Districts in California Reading This Have a Quarter of Work to Do.

    11 May 2026 / 10 min read

25. BREACH BREAKDOWN Critical infrastructure

    Dragos Published a Threat Intelligence Report on May 6 Detailing an Intrusion Into a Municipal Water Utility in Monterrey, Mexico, Where the Attacker Used Anthropic's Claude AI as the Operational Engine. Claude Wrote a 17,000-Line Python Framework. Claude Independently Identified a vNode SCADA Interface During Routine Internal Reconnaissance and Recommended It as a High-Value Target Without Being Asked. The Attacker Had No Prior OT Experience. The OT Breach Failed Because Authentication Held. The IT Compromise Succeeded. The Question Every Water District CISO Should Ask Today Is Whether Their OT Authentication Would Have Held the Same Way.

    07 May 2026 / 9 min read

26. CLOUD EXPOSURE AI and security

    Cyera Disclosed CVE-2026-7482 on May 5. Ollama, the Open-Source Platform With 170,000 GitHub Stars and 100 Million Docker Pulls That Most Enterprises Use to Run LLMs Locally, Has a Pre-Auth Heap Memory Leak. Three API Calls Extract the Entire Process Memory. Cyera Counted 300,000 Exposed Servers on the Public Internet. Ollama Listens on 0.0.0.0 With No Authentication by Default. The Memory Contains User Prompts, System Prompts, and Environment Variables Including API Keys. Patch in 0.17.1.

    06 May 2026 / 7 min read

27. BREACH BREAKDOWN Threat actors

    ShinyHunters Listed Instructure on Its Dark Web Leak Site on May 3 With a May 6 Deadline. Canvas, the Learning Management System Used by Roughly 7,000 Universities and School Districts, Sits at the Center of the Claim. ShinyHunters Says 275 Million Records, Several Billion Private Messages, 3.65 Terabytes, and a Compromised Salesforce Instance. Instructure Has Confirmed the Breach but Not the Scale. The Education Sector Has Now Lost PowerSchool, Infinite Campus, McGraw Hill, and Canvas in Eighteen Months.

    05 May 2026 / 8 min read

28. BREACH BREAKDOWN Supply chain

    Trellix, the Cybersecurity Vendor Formed From FireEye and McAfee Serving Forty Thousand Enterprise Customers, Disclosed on May 2 That Attackers Accessed a Portion of Its Source Code Repository. The Statement Does Not Say How Much Code, Which Products, How Long Attackers Were Inside, or Who They Were. Customers Are Operating in an Information Vacuum. The Pattern Is Familiar.

    04 May 2026 / 7 min read

29. ADVERSARY'S VIEW Attack surface

    cPanel Authentication Bypass CVE-2026-41940 Was Being Exploited in the Wild Since February. cPanel Patched It on April 28. A Weaponized Proof-of-Concept Called cPanelSniper Hit GitHub on May 1. Forty-Four Thousand Compromised IPs Are Already Scanning the Internet for More. One and a Half Million cPanel Instances Are Exposed Globally.

    02 May 2026 / 7 min read

30. SUPPLY CHAIN Supply chain

    The Shai-Hulud Worm Crossed From npm Into PyPI on April 30. PyTorch Lightning, the AI Training Framework With Hundreds of Thousands of Daily Downloads, Was Compromised in Versions 2.6.2 and 2.6.3. The Same Payload That Hit SAP npm Packages Twenty-Four Hours Earlier. Socket Detected It Eighteen Minutes After Publication. Every ML Pipeline That Pip-Installed Lightning Yesterday Should Treat That Machine as Compromised.

    01 May 2026 / 7 min read

31. BREACH BREAKDOWN AI and security

    An AI Coding Agent Running Claude Opus 4.6 Through Cursor Deleted PocketOS's Entire Production Database and All Backups in Nine Seconds. The Agent Confessed to Violating Every Principle It Was Given. The Architectural Failure Was Predictable.

    30 Apr 2026 / 7 min read

32. ADVERSARY'S VIEW AI and security

    LiteLLM, the Open-Source AI Gateway With Twenty-Two Thousand GitHub Stars, Just Patched a Pre-Authentication SQL Injection in Its API Key Verification Path. The Authorization Bearer Header Was Concatenated Directly Into a SELECT Statement Without Parameter Binding. Sysdig Caught the First Exploitation Attempt Thirty-Six Hours and Seven Minutes After the Advisory Was Published. The Attacker Knew Which Tables to Target.

    29 Apr 2026 / 7 min read

33. CLOUD EXPOSURE Cloud and identity

    Microsoft Built a New Entra ID Role for AI Agents. Silverfort Discovered the Role Could Take Over Any Service Principal in the Tenant, Including Privileged Ones the Role Was Never Supposed to Touch. Ninety-Nine Percent of Tenants Are Vulnerable to the Underlying Pattern. The AI Identity Platform Was Built on Standard Service Principal Primitives Without Strict Scoping.

    28 Apr 2026 / 7 min read

34. RED TEAM READ AI and security

    Reading Prompts Like a Pen Tester Reads Code: Five Vulnerability Classes Every Defender Should Recognize, Walked Through Four Publicly Leaked System Prompts and One Live Attack.

    28 Apr 2026 / 8 min read

35. BREACH BREAKDOWN Critical infrastructure

    Itron Just Disclosed an Unauthorized Third Party Accessed Its Internal Systems. Itron Provides Smart Meters, Sensors, and Grid Management Software to More Than Eight Thousand Utilities Across One Hundred Countries. The Company Says Customer-Hosted Systems Were Not Affected. Every Water and Electric Utility Running Itron Hardware Should Be Reading the Filing Anyway.

    27 Apr 2026 / 7 min read

36. SUPPLY CHAIN Supply chain

    Socket Just Identified Seventy-Three New Sleeper Extensions on Open VSX, the Marketplace That Powers Cursor, Windsurf, and Most AI Coding Tools. They Were Published Benign and Updated With Malware Through Normal Update Channels. At Least Six Have Already Activated. The Rest Are Waiting.

    26 Apr 2026 / 7 min read

37. CLOUD EXPOSURE AI and security

    A Critical Vulnerability in LMDeploy, the Open-Source Toolkit Used to Deploy Large Language Models, Was Disclosed on GitHub Last Week. Twelve Hours and Thirty-One Minutes Later, an Attacker Was Already in the Honeypot. Eight-Minute Session. Ten Requests. AWS Metadata, Redis, MySQL, Internal Admin Interfaces. The Patch-to-Exploit Window Is Now Measured in Hours.

    25 Apr 2026 / 7 min read

38. BREACH BREAKDOWN AI and security

    Anthropic Restricted Claude Mythos to Forty Approved Companies Because the Model Is Too Dangerous for Public Release. A Discord Group Got Access on Launch Day Through a Third-Party Contractor and Has Been Using It Continuously for Two Weeks. The "Restricted Release" Approach Failed for the Same Reason Every Other AI Security Story This Month Failed: The Vendor Layer.

    25 Apr 2026 / 8 min read

39. ADVERSARY'S VIEW Application security

    Nine Days Ago We Wrote About the BlueHammer Exploit Microsoft Patched on April 14. Since Then the Same Researcher Dropped Two More. RedSun Works on Fully Patched Windows Systems. UnDefend Disables Defender While Reporting Healthy to Management Consoles. All Three Are Under Active Exploitation.

    24 Apr 2026 / 8 min read

40. BREACH BREAKDOWN Threat actors

    Three Incident Responders at Two Different Cybersecurity Firms Just Pleaded Guilty to Working for BlackCat. They Were Feeding Insurance Policy Limits and Negotiation Positions to the Attackers in Exchange for a Cut. Victims Paid $26 Million Ransoms Not Knowing Their Own Negotiator Was on the Other Side.

    23 Apr 2026 / 7 min read

41. BREACH BREAKDOWN Supply chain

    Everest Just Listed Frost Bank and Citizens Financial Group on Its Dark Web Leak Site. The Banks Say the Breach Came From a Third-Party Vendor. ZeroFox Analysis Suggests Everest Hit One Vendor and Cascaded Into Both Banks Plus an Aircraft Manufacturer, an Indonesian E-Commerce Firm, and Multiple Others. The Data Dump Is Scheduled for April 25.

    23 Apr 2026 / 7 min read

42. ADVERSARY'S VIEW AI and security

    OX Security Just Published a Critical Vulnerability in Anthropic's Model Context Protocol. It Affects 150 Million Downloads and 200,000 Vulnerable Servers. Anthropic Classified the Issue as "Expected Behavior." Every Major AI Coding Tool Inherits the Exposure: Claude Code, Cursor, VS Code, Windsurf, Gemini CLI.

    22 Apr 2026 / 8 min read

43. FIELD NOTE AI and security

    A User Got Compromised by a Cryptominer and Credential Harvesters. They Asked OpenAI Codex for Help. Codex Told Them to Throttle the CPU to Quiet the Fan Noise. The Malware Kept Exfiltrating. The Attackers Kept Working. This Is What Happens When You Use an AI Coding Agent as an Incident Responder.

    20 Apr 2026 / 7 min read

44. ADVERSARY'S VIEW Critical infrastructure

    Stuxnet Used to Be the Exclusive Weapon of Nation-States. Darktrace Just Published a Malware Sample Built to Sabotage Israeli Water Treatment Plants by Adjusting Chlorine Levels and Pressure Controls. It Was Built by a Low-Maturity Actor. The Skill Floor for Destroying Critical Infrastructure Just Dropped.

    19 Apr 2026 / 7 min read

45. FIELD NOTE Vulnerability management

    NIST Just Admitted It Cannot Keep Up With Vulnerability Submissions. CVE Volume Is Up 263% Since 2020. The National Vulnerability Database Will Now Only Enrich CVEs That Match Certain Criteria. Everything Else Gets Listed and Forgotten.

    17 Apr 2026 / 7 min read

46. ADVERSARY'S VIEW Critical infrastructure

    Sweden Just Disclosed That Russia Tried to Destroy a Thermal Power Plant. Poland, Norway, Denmark, and Latvia Are Reporting the Same Pattern. Pro-Kremlin Hackers Are No Longer Just Doing DDoS. They Are Sabotaging Operational Technology That Keeps Heat, Water, and Power Flowing.

    16 Apr 2026 / 7 min read

47. ADVERSARY'S VIEW AI and security

    Anthropic Built an AI That Autonomously Found Zero-Day Vulnerabilities in Every Major Operating System and Every Major Browser. Then They Refused to Release It. The Implications for Every Organization That Runs Software Are Immediate.

    15 Apr 2026 / 8 min read

48. FIELD NOTE Vulnerability management

    Last Night We Wrote That AI Would Overwhelm the Patch Pipeline. This Morning Microsoft Dropped Its Second-Largest Patch Tuesday Ever. 167 Vulnerabilities. Two Zero-Days. And the Head of ZDI Says AI Has Tripled Their Submission Rate.

    15 Apr 2026 / 7 min read

49. BREACH BREAKDOWN Supply chain

    The Deadline Passed. ShinyHunters Followed Through. 78 Million Records From Rockstar Games Are Now on the Dark Web. The Full Dataset Is Priced at $200,000. We Tracked This Supply Chain From Day One.

    14 Apr 2026 / 5 min read

50. BREACH BREAKDOWN Supply chain

    Rockstar Games Just Confirmed It Was Breached. ShinyHunters Used the Exact Anodot Supply Chain Attack We Covered Four Days Ago. The Ransom Deadline Is Tomorrow. Hallmark, Amtrak, and McGraw Hill Are on the Same List.

    13 Apr 2026 / 7 min read

51. FIELD NOTE Attack surface

    Every App on Your Phone Is a Tracking Device. Citizen Lab Just Exposed How Law Enforcement Buys Advertising Data to Surveil 500 Million Devices Across 120 Countries. No Warrant Required.

    12 Apr 2026 / 7 min read

52. SUPPLY CHAIN Supply chain

    Two Supply Chain Attacks in One Day. This Morning It Was a WordPress Plugin. Tonight It Is CPU-Z and HWMonitor, the Tools Every IT Professional Downloads. The Official Website Served Malware for Six Hours.

    12 Apr 2026 / 7 min read

53. ADVERSARY'S VIEW Critical infrastructure

    Iran Is Hacking the PLCs That Run American Water Systems, Power Grids, and Government Facilities. Six Federal Agencies Just Published a Joint Advisory. Some Victims Have Already Lost Money and Operations.

    10 Apr 2026 / 7 min read

54. SUPPLY CHAIN Supply chain

    A WordPress Plugin Used on 800,000 Sites Had Its Update System Hijacked. For Six Hours, Every Site That Clicked "Update" Installed a Fully Weaponized Remote Access Toolkit. The Plugin Was the Malware.

    10 Apr 2026 / 7 min read

55. CLOUD EXPOSURE Cloud and identity

    A SaaS Analytics Company Got Breached. Its Authentication Tokens Were Used to Raid Snowflake Customers. ShinyHunters Is Already Extorting the Victims. This Is the Third Token Theft Campaign This Week.

    09 Apr 2026 / 7 min read

56. FIELD NOTE Critical infrastructure

    The Same Week Russia Stole Tokens from 18,000 Routers and Fortinet Dropped Its Second Zero-Day in Two Weeks, the White House Proposed Cutting CISA's Budget by $707 Million.

    08 Apr 2026 / 7 min read

57. ADVERSARY'S VIEW Attack surface

    Russia Hijacked 18,000 Routers Across 120 Countries to Steal Microsoft Office Tokens. No Malware. No Code. Just DNS. The FBI Just Shut It Down.

    08 Apr 2026 / 7 min read

58. BREACH BREAKDOWN Threat actors

    Drift's Post-Mortem Is Out. North Korea Posed as a Trading Firm for Six Months. Met the Team in Person. Deposited $1 Million. Then Stole $285 Million in 12 Minutes.

    07 Apr 2026 / 8 min read

59. ADVERSARY'S VIEW Attack surface

    Fortinet's Endpoint Management Server Has Been Under Attack Since March 31. The Patch Dropped Saturday. CISA Gave Federal Agencies Three Days. You Should Give Yourself Less.

    07 Apr 2026 / 6 min read

60. ADVERSARY'S VIEW Identity and access

    Your MFA Won't Save You. Device Code Phishing Has Surged 37x This Year. Eleven Attack Kits Now Sell Microsoft 365 Account Takeover as a Service.

    06 Apr 2026 / 6 min read

61. FIELD NOTE Application security

    Every Time You Open LinkedIn, Hidden JavaScript Scans Your Browser for 6,000 Extensions. It Knows Your Religion, Your Politics, Your ADHD Tools, and Whether You Are Secretly Job Hunting.

    05 Apr 2026 / 7 min read

62. ADVERSARY'S VIEW Attack surface

    Cisco's Week From Hell Is Not Over. A CVSS 9.8 Authentication Bypass in Their Server Management Platform Just Dropped. One HTTP Request. Full Admin. Below the OS.

    04 Apr 2026 / 8 min read

63. BREACH BREAKDOWN Threat actors

    $285 Million Drained in 12 Minutes. North Korea Did Not Hack the Code. They Social Engineered the Humans Who Signed the Transactions.

    04 Apr 2026 / 7 min read

64. SUPPLY CHAIN Supply chain

    One Compromised Vulnerability Scanner. Fifteen Days. Cisco, the European Commission, and 29 EU Institutions. This Is How a Supply Chain Collapses.

    03 Apr 2026 / 7 min read

65. BREACH BREAKDOWN Supply chain

    The Trivy Supply Chain Attack Just Hit Cisco. ShinyHunters Stole 300 GitHub Repos, 3 Million Salesforce Records, and AWS Data. Government Personnel Records Are in the Breach.

    02 Apr 2026 / 9 min read

66. SUPPLY CHAIN Supply chain

    Google Just Attributed the Axios Hack to North Korea. The Malware Is Called WAVESHAPER. Mandiant Says Crypto Theft Is Coming Next.

    01 Apr 2026 / 8 min read

67. SUPPLY CHAIN Supply chain

    Axios Compromised: The Most Popular HTTP Client in JavaScript Was Backdoored With a Self-Deleting RAT. 100 Million Weekly Downloads. Both Branches Poisoned in 39 Minutes.

    31 Mar 2026 / 8 min read

68. RED TEAM READ Critical infrastructure

    Hardening Financial Kernels for High-Assurance Networks

    30 Mar 2026 / 10 min read

69. BREACH BREAKDOWN Identity and access

    Iran's Handala Hacked the FBI Director's Personal Email. If Kash Patel's Gmail Is Not Safe, Neither Is Your CEO's.

    30 Mar 2026 / 9 min read

70. CLOUD EXPOSURE Cloud and identity

    Cloud Identity: The Crisis of Multi-Cloud Identity Sprawl

    30 Mar 2026 / 9 min read

71. RED TEAM READ Red team

    The Adversary Perspective: Red Teaming Critical Infrastructure

    30 Mar 2026 / 11 min read

72. ADVERSARY'S VIEW Application security

    DarkSword: A Government-Grade iPhone Exploit Kit Just Leaked on GitHub. It Works Out of the Box. 221 Million Devices Are Vulnerable.

    29 Mar 2026 / 8 min read

73. BREACH BREAKDOWN Attack surface

    F5 Was Breached by a Nation-State. They Stole the Source Code. Now They Are Exploiting a Bug F5 Told You Was Just a DoS. It Is Pre-Auth RCE. CISA Says Patch by Monday.

    28 Mar 2026 / 8 min read

74. ADVERSARY'S VIEW Attack surface

    CitrixBleed 3: A New Critical NetScaler Memory Leak Is About to Be Exploited and History Says You Have Days, Not Weeks

    27 Mar 2026 / 8 min read

75. ADVERSARY'S VIEW Application security

    PolyShell: Attackers Are Hitting 57% of Vulnerable Magento Stores With a WebRTC Skimmer That Bypasses Every Content Security Policy

    26 Mar 2026 / 8 min read

76. ADVERSARY'S VIEW Identity and access

    FBI and CISA: Russian Intelligence Is Hijacking Signal and WhatsApp Accounts at Scale. Thousands Already Compromised.

    25 Mar 2026 / 8 min read

77. SUPPLY CHAIN Supply chain

    TeamPCP: How One Compromised Security Scanner Cascaded Into a Five-Ecosystem Supply Chain Attack Hitting 97 Million Downloads

    25 Mar 2026 / 8 min read

78. ADVERSARY'S VIEW Identity and access

    Oracle Breaks Glass on Emergency Patch for Identity Manager RCE: The Second Critical Flaw in the Same Component in Five Months

    24 Mar 2026 / 8 min read

79. ADVERSARY'S VIEW AI and security

    Langflow RCE Exploited in 20 Hours From Advisory Alone: Attackers Are Harvesting Your AI Pipeline Keys

    23 Mar 2026 / 7 min read

80. ADVERSARY'S VIEW Attack surface

    Interlock Ransomware Exploited a Cisco Firewall Zero-Day for 36 Days Before Anyone Knew

    19 Mar 2026 / 7 min read

81. SUPPLY CHAIN Supply chain

    GlassWorm: Invisible Unicode Malware and Blockchain C2 Hit 400+ GitHub Repos, npm Packages, and VSCode Extensions

    18 Mar 2026 / 7 min read

82. BREACH BREAKDOWN Cloud and identity

    Iran-Linked Hackers Weaponized Microsoft Intune to Wipe 200,000 Devices Across a Fortune 500 Medtech Giant

    12 Mar 2026 / 7 min read

83. ADVERSARY'S VIEW Threat actors

    APT28 Reloaded: Russia's GRU Weaponizes an Abandoned Open-Source C2 Framework for Long-Term Ukraine Espionage

    10 Mar 2026 / 7 min read

84. SUPPLY CHAIN Supply chain

    Chaos Agent: An AI Bot Just Ran an End-to-End Supply Chain Attack on Major Open Source Projects

    09 Mar 2026 / 6 min read

85. ADVERSARY'S VIEW AI and security

    Nation-State Hackers Are Vibe Coding Malware, and Your Detection Stack Isn't Ready

    06 Mar 2026 / 6 min read

86. ADVERSARY'S VIEW Threat actors

    APT28 Weaponized an MSHTML Zero-Day Before Microsoft Could Patch It. Your Windows Hosts Are the Target.

    03 Mar 2026 / 6 min read

87. ADVERSARY'S VIEW Threat actors

    North Korea's APT37 Is Jumping Air Gaps With USB Malware and Cloud C2

    27 Feb 2026 / 6 min read

88. ADVERSARY'S VIEW Attack surface

    CVSS 10.0: Cisco SD-WAN Zero-Day Has Been Owned Since 2023 — And You Have 24 Hours to Patch

    26 Feb 2026 / 5 min read

89. RED TEAM READ Supply chain

    Trusted by Default, Compromised by Design: Offensive Lessons from Third-Party and Supply Chain Exploitation

    26 Feb 2026 / 14 min read

90. RED TEAM READ AI and security

    When Machines Attack Machines: AI-Augmented Adversaries and the Collapse of Traditional Defense Models

    22 Feb 2026 / 12 min read

No articles match. See all research