Every daily digest from the last 90 days, newest first. Click a row to open that day's digest.
| Date | Coverage | Preview |
|---|---|---|
| 2026-11-02 | 57 articles, 3 CVEs, 20 breaches | North Korean state-sponsored actor TraderTraitor executed a record-breaking $6.3 billion theft against Binance hot wallets on October 29, 2026. Law enforcement agencies have identified over 600 wallet addresses linked to the laundering of... |
| 2026-11-01 | 8 articles, 0 CVEs, 2 breaches | North Korea-aligned actors under the TraderTraitor moniker are responsible for a historic $6.43 billion theft from Binance, marking one of the largest crypto heists in history. CISA has urgently prioritized the remediation of two critical... |
| 2026-10-31 | 61 articles, 52 CVEs, 2 breaches | Threat actors are increasingly integrating generative AI into both offensive operations and internal tool exploitation. Chainalysis disclosed a breach involving an external actor using "offensive agentic" techniques to access customer... |
| 2026-10-30 | 55 articles, 8 CVEs, 7 breaches | North Korean state-sponsored group TraderTraitor has executed a massive $6 billion cryptocurrency theft from Binance, signaling an escalation in financial motivation for nation-state actors. Concurrently, Chinese state-aligned clusters... |
| 2026-10-29 | 67 articles, 5 CVEs, 18 breaches | Chinese state-sponsored actors Volt Typhoon and Warp Panda are conducting sophisticated, multi-vector campaigns against critical infrastructure and the U.S. legal sector. Volt Typhoon is leveraging the 'Silent Train' framework to steal... |
| 2026-10-28 | 64 articles, 9 CVEs, 10 breaches | State-sponsored actors from China are executing a high-tempo campaign of zero-day exploitation against critical infrastructure. The group identified as Volt Typhoon is utilizing its 'Silent Train' relay network to target telecommunications... |
| 2026-10-27 | 75 articles, 10 CVEs, 17 breaches | The threat landscape on October 27, 2026 is defined by the widespread exploitation of critical infrastructure vulnerabilities and sophisticated state-sponsored espionage. The PHP2Shell family of flaws (CVE-2026-109618 and CVE-2026-109619)... |
| 2026-10-26 | 44 articles, 3 CVEs, 7 breaches | Active exploitation of PHP2Shell vulnerabilities has escalated from reconnaissance to fully working remote code execution shells. The Mirai operator group is leveraging these flaws to distribute the 'Potassium' malware variant, indicating... |
| 2026-10-25 | 7 articles, 4 CVEs, 1 breaches | Threat actors are increasingly leveraging agentic AI platforms to accelerate post-exploitation phases, as evidenced by a recent attack against a European government entity. This incident highlights the convergence of traditional software... |
| 2026-10-24 | 6 articles, 2 CVEs, 1 breaches | A critical dual-threat cluster has emerged involving the active exploitation of zero-day vulnerabilities in Arista VeloCloud Orchestrator and Collabora Online. CISA has added both flaws to its Known Exploited Vulnerabilities list... |
| 2026-10-23 | 45 articles, 7 CVEs, 3 breaches | Unidentified threat actors are conducting a coordinated campaign exploiting three critical zero-day vulnerabilities in Arista's VeloCloud Orchestrator to compromise enterprise infrastructure. This persistent activity, spanning four months... |
| 2026-10-22 | 56 articles, 6 CVEs, 7 breaches | A coordinated espionage campaign led by the Chinese state-aligned threat actor Storm-0940 has compromised the IT management provider ConnectWise. This group utilized the autonomous AI penetration testing framework ARTEX to execute rapid... |
| 2026-10-21 | 68 articles, 3 CVEs, 7 breaches | A coordinated wave of ransomware attacks is currently dominating the threat landscape, driven primarily by Qilin and INC groups exploiting critical authentication bypass vulnerabilities in Palo Alto Networks products. These actors are... |
| 2026-10-20 | 65 articles, 8 CVEs, 17 breaches | Ransomware groups Qilin and INC are actively exploiting CVE-2026-0257 to bypass multi-factor authentication on Palo Alto Networks devices. This critical vulnerability allows attackers to establish unauthorized VPN access, facilitating... |
| 2026-10-19 | 44 articles, 0 CVEs, 10 breaches | Threat actors are aggressively exploiting supply chain vulnerabilities in software development and management platforms, demonstrating a shift toward compromising trusted update mechanisms. GhostAction has evolved its GitHub attack... |
| 2026-10-18 | 6 articles, 0 CVEs, 2 breaches | Unknown threat actors have compromised Microsoft 365 tenants by leveraging unauthorized access to ConnectWise application identities. This incident resulted in the suspension of seven specific ConnectWise Cloud Backup identities to contain... |
| 2026-10-17 | 8 articles, 0 CVEs, 5 breaches | A sophisticated supply chain attack named MALFEX continues to evolve, with researchers identifying the malicious npm package 'imgdecode' that hides shellcode loaders within Windows native addons. This activity highlights a growing trend of... |
| 2026-10-16 | 299 articles, 258 CVEs, 8 breaches | A China-nexus espionage group identified as ARMORY CASTLE is actively exploiting a zero-day vulnerability in BeyondTrust Remote Support to conduct targeted cyberespionage. The actors have deployed custom tools including the SAWFLY web... |
| 2026-10-15 | 88 articles, 43 CVEs, 7 breaches | The most significant operational development today is the confirmation of Candiru, an Israeli mercenary spyware vendor, executing zero-click infections through compromised digital advertising infrastructure. This coordinated campaign... |
| 2026-10-14 | 70 articles, 15 CVEs, 3 breaches | Law enforcement agencies executed a coordinated global takedown of Storm-3119, dismantling the YAM Store cybercrime marketplace and associated phishing infrastructure. This operation disrupted an ecosystem that delivered over one billion... |
| 2026-10-13 | 44 articles, 2 CVEs, 9 breaches | A critical chain of three zero-day vulnerabilities in Ivanti Connect Secure appliances is being actively exploited to gain root access. The threat actor, identified as UTA0576, is conducting credential theft and Active Directory... |
| 2026-10-12 | 42 articles, 8 CVEs, 9 breaches | The threat landscape this week is defined by the rapid exploitation of critical software vulnerabilities alongside significant enforcement actions against cybercrime ecosystems. Attackers have swiftly weaponized maximum-severity flaws in... |
| 2026-10-11 | 2 articles, 0 CVEs, 2 breaches | A significant data breach has occurred at Nippon Columbia, resulting in the exposure of over 8.6 million records belonging to customer and employee data. This incident involves contractor systems within the Japanese entertainment industry... |
| 2026-10-10 | 11 articles, 0 CVEs, 3 breaches | Law enforcement has intensified its disruption of the ShinyHunters extortion group through multiple arrests in October. A Canadian cybersecurity firm co-founder was detained for allegedly aiding the group’s recent breach of FBI recruitment... |
| 2026-10-09 | 49 articles, 5 CVEs, 6 breaches | Law enforcement agencies have intensified their disruption of the ShinyHunters data extortion group through arrests in Jordan and the United States. This pressure follows a series of high-profile breaches targeting federal recruitment... |
| 2026-10-08 | 69 articles, 16 CVEs, 8 breaches | An international coalition, led by the FBI and CISA, has seized infrastructure supporting Flax Typhoon, a China-linked espionage campaign associated with Integrity Technology Group. This operation disrupts the group's MicroScan... |
| 2026-10-07 | 59 articles, 2 CVEs, 11 breaches | The threat landscape for October 7, 2026, is defined by the convergence of high-severity credential harvesting campaigns and novel autonomous AI threats. The FortiBleed operation remains a critical global risk, actively locking out... |
| 2026-10-06 | 50 articles, 1 CVEs, 10 breaches | Denmark’s national population registry suffered a catastrophic data breach exposing approximately 8.8 million citizens through the abuse of a third-party supplier’s legitimate credentials. This incident highlights severe supply chain... |
| 2026-10-05 | 47 articles, 3 CVEs, 11 breaches | Law enforcement agencies have successfully dismantled two major digital extortion syndicates in coordinated international operations. The arrests of ShinyHunters leader Rey in Jordan and KillSec’s young leadership across nine countries... |
| 2026-10-04 | 8 articles, 1 CVEs, 1 breaches | A critical zero-day vulnerability in Citrix NetScaler appliances is actively being exploited to launch denial-of-service attacks against SAML authentication mechanisms. Organizations running affected versions must prioritize immediate... |
| 2026-10-03 | 19 articles, 1 CVEs, 5 breaches | A coordinated campaign led by the China-linked threat actor Warlock is actively targeting critical infrastructure in Portuguese- and Spanish-speaking regions. This group exploits SharePoint vulnerabilities to deploy ransomware while... |
| 2026-10-02 | 36 articles, 5 CVEs, 3 breaches | Warlock continues its relentless exploitation of Microsoft SharePoint vulnerabilities to target critical infrastructure across Portuguese- and Spanish-speaking regions. This sustained campaign demonstrates the group’s capability to... |
| 2026-10-01 | 51 articles, 6 CVEs, 8 breaches | This morning's threat landscape is defined by two converging critical vulnerabilities actively exploited in zero-day campaigns. Fortinet FortiMail faces an active zero-day attack exploiting CVE-2026-104286, allowing unauthenticated file... |
| 2026-09-30 | 49 articles, 8 CVEs, 6 breaches | Active exploitation of critical zero-day vulnerabilities in enterprise infrastructure remains the dominant threat this week. Cisco Catalyst SD-WAN Manager and Citrix NetScaler appliances are being targeted by unidentified actors leveraging... |
| 2026-09-29 | 60 articles, 6 CVEs, 9 breaches | The threat landscape on September 29, 2026, is defined by a severe escalation in data extortion and the active exploitation of critical infrastructure vulnerabilities. ShinyHunters has intensified its global campaign against Oracle... |
| 2026-09-28 | 47 articles, 4 CVEs, 11 breaches | A coordinated campaign exploiting two critical zero-day vulnerabilities in Citrix NetScaler ADC and Gateway has triggered urgent global warnings from CISA and major vendors. Attackers are conducting unauthenticated remote code execution... |
| 2026-09-27 | 11 articles, 3 CVEs, 2 breaches | The threat landscape on September 27, 2026, is dominated by the active exploitation of two unpatched zero-day vulnerabilities in Citrix NetScaler appliances. Security firm watchTowr confirmed that these remote code execution flaws are... |
| 2026-09-26 | 18 articles, 2 CVEs, 3 breaches | Threat actors are actively leveraging known vulnerabilities to execute high-impact attacks across global infrastructure. A coordinated campaign linked to ShinyHunters is exploiting a critical Oracle PeopleSoft flaw to bypass web... |
| 2026-09-25 | 158 articles, 117 CVEs, 7 breaches | North Korean state-sponsored actors have executed a significant financial theft against cryptocurrency exchange Bitget, stealing $351.6 million through backend infrastructure compromise. This incident underscores the heightened risk to... |
| 2026-09-24 | 58 articles, 5 CVEs, 13 breaches | A critical WordPress path traversal vulnerability, tracked as CVE-2026-87902, is being actively exploited in the wild with minimal delay. Attackers are using proof-of-concept code to deploy webshells and execute arbitrary code on unpatched... |
| 2026-09-23 | 58 articles, 11 CVEs, 5 breaches | The extortion group ShinyHunters has publicly claimed a breach of the FBI, alleging use of an undisclosed zero-day vulnerability in Oracle PeopleSoft to compromise FBIjobs.gov. This incident is part of an escalating digital feud between... |
| 2026-09-22 | 62 articles, 10 CVEs, 9 breaches | Arista and Check Point confirm active exploitation of critical zero-day vulnerabilities in their respective orchestration and management infrastructure. The unauthenticated remote code execution flaw in Arista VeloCloud Orchestrator... |
| 2026-09-21 | 45 articles, 1 CVEs, 6 breaches | A North Korean-linked threat group identified as WaterPlum has compromised approximately 30,000 devices across 100 countries in the 'Contagious Interview' campaign. This coordinated effort utilizes fake job applications for AI and... |
| 2026-09-20 | 2 articles, 0 CVEs, 0 breaches | A significant supply chain attack vector has emerged involving malicious npm packages that evade traditional install-script defenses. The 'indexed-btree' package is being used to hide malicious code within its normal runtime behavior... |
| 2026-09-19 | 17 articles, 3 CVEs, 3 breaches | The threat landscape today is defined by aggressive activity from the ShinyHunters extortion group, which breached the Clop ransomware leak site and compromised Florida DMV infrastructure using stolen police credentials. This multi-vector... |
| 2026-09-18 | 47 articles, 7 CVEs, 9 breaches | The current threat landscape is defined by sophisticated supply chain compromises and the continued evolution of AI-assisted weaponization. A critical supply chain attack against email provider Brevo has enabled the injection of ClickFix... |
| 2026-09-17 | 66 articles, 20 CVEs, 7 breaches | A critical zero-day vulnerability in Cisco Identity Services Engine is actively being exploited in the wild. This flaw, tracked as CVE-2026-76460, allows unauthenticated remote attackers to bypass authentication via insufficient API... |
| 2026-09-16 | 57 articles, 5 CVEs, 5 breaches | Threat actors are rapidly leveraging artificial intelligence to accelerate both attack development and execution speeds. A notable incident involves an adversary hijacking an AI coding assistant session to distribute the Shai-Hulud worm... |
| 2026-09-15 | 260 articles, 209 CVEs, 7 breaches | Iranian state-sponsored actors are intensifying espionage efforts against dissidents and journalists using the CHOSEN BRICK malware, which is controlled via Telegram. Simultaneously, a coordinated campaign known as PasteSwitch is... |
| 2026-09-14 | 46 articles, 3 CVEs, 6 breaches | Japan’s Digital Agency suffered a significant data breach exposing the personal records of 246,000 government employees. The incident resulted from the exploitation of a known VPN vulnerability by an unknown actor, prompting immediate... |
| 2026-09-13 | 9 articles, 1 CVEs, 2 breaches | A China-aligned espionage group identified as UNC3569 is actively exploiting a critical vulnerability in Tencent's Sogou Input Method to deploy the GrayRabbit backdoor. This campaign targets government, finance, education, and technology... |
| 2026-09-12 | 15 articles, 10 CVEs, 0 breaches | Threat actors are actively exploiting multiple critical software supply chain and infrastructure vulnerabilities to gain persistent access in high-value environments. CISA has added several known exploited flaws, including a critical... |
| 2026-09-11 | 67 articles, 24 CVEs, 7 breaches | A coordinated cluster of threats is dominating the landscape, driven by Russian state-sponsored actor Midnight Blizzard and criminal extortion group ShinyHunters. Midnight Blizzard has escalated its tactics by integrating Anthropic's... |
| 2026-09-10 | 56 articles, 5 CVEs, 6 breaches | Identity verification provider IDScan.net confirmed a massive breach involving the exposure of 153 million driver's license scans, with stolen data currently being sold on the Nexus marketplace by actors linked to Russian criminal groups.... |
| 2026-09-09 | 60 articles, 8 CVEs, 6 breaches | Russian-aligned cybercriminal groups are deploying autonomous AI agents to conduct mass credential harvesting and supply chain compromises across cloud and Kubernetes infrastructure. This coordinated campaign involves actors TeamPCP and... |
| 2026-09-08 | 40 articles, 1 CVEs, 7 breaches | A critical breach of the Liquid Network compromised its federation wallet, resulting in the theft of approximately $320 million in Bitcoin. The attackers, claiming to be white-hat hackers, returned most of the funds after negotiating for a... |
| 2026-09-07 | 34 articles, 0 CVEs, 7 breaches | North Korean state-aligned actors Lazarus Group and APT37 are conducting active espionage campaigns against South Korean industries. These operations utilize a modified HAProxy load balancer to deploy a persistent backdoor, targeting the... |
| 2026-09-06 | 6 articles, 0 CVEs, 1 breaches | The United States has issued a ten million dollar reward for information leading to the capture of Amir Yaryab. This senior Iranian official leads the IRGC Cyber-Electronic Command and is accused of directing attacks on critical... |
| 2026-09-05 | 12 articles, 4 CVEs, 2 breaches | The threat landscape today is dominated by active exploitation of high-severity vulnerabilities in popular software platforms. A critical zero-day in Elementor Pro has triggered massive automated attack campaigns, while unpatched flaws in... |
| 2026-09-04 | 41 articles, 6 CVEs, 5 breaches | Global threat activity today centers on a massive identity theft investigation involving IDScan.net. Federal authorities have opened formal probes after over 153 million driver's license records were offered for sale on dark web markets.... |
| 2026-09-03 | 75 articles, 35 CVEs, 9 breaches | A massive data breach involving IDScan.net has resulted in the exposure of over 164 million identity records, including driver’s license scans, which are being actively monetized on a dark web marketplace named Nexus. This incident... |
| 2026-09-02 | 62 articles, 9 CVEs, 8 breaches | Active exploitation of critical zero-day vulnerabilities in SonicWall SMA1000 appliances and Sangoma Switchvox VoIP systems poses an immediate risk to network infrastructure. These unauthenticated flaws allow threat actors to execute... |
| 2026-09-01 | 47 articles, 5 CVEs, 9 breaches | Today’s threat landscape is defined by a surge in active exploitation of critical, unpatched vulnerabilities in widely used enterprise software. Specifically, the JFrog Artifactory authentication bypass and Langflow code injection flaws... |
| 2026-08-31 | 43 articles, 2 CVEs, 12 breaches | A critical zero-day vulnerability chain in PaperCut NG/MF print management software is being actively exploited in the wild, prompting immediate remediation requirements for all organizations using this infrastructure. The US government... |
| 2026-08-30 | 8 articles, 0 CVEs, 4 breaches | FulcrumSec has emerged as a significant threat actor by claiming responsibility for the breach of Manchester Airports Group. This incident involved the exfiltration of 86 GB of data, including sensitive customer records and travel... |
| 2026-08-29 | 11 articles, 1 CVEs, 7 breaches | The ShinyHunters extortion group has executed a coordinated campaign targeting critical infrastructure and major corporations, recently compromising McKesson with 284 million stolen patient records via voice phishing against Okta... |
| 2026-08-28 | 349 articles, 313 CVEs, 8 breaches | Based on the data provided, here is a summary of the security vulnerabilities associated with Chromium (which affects Microsoft Edge due to its Chromium base) and other related topics. The list contains a large number of CVEs assigned in... |
| 2026-08-27 | 58 articles, 7 CVEs, 8 breaches | Federal authorities have charged two individuals in Australia with connection to TeamPCP, an APT group responsible for extensive software supply chain attacks affecting over 2,500 organizations through compromised tools like Trivy and... |
| 2026-08-26 | 56 articles, 9 CVEs, 4 breaches | Boston Scientific has confirmed a significant cyberattack that disrupted global IT systems, network connectivity, and customer order processing. The medical device manufacturer is engaging external forensic experts to contain the incident... |
| 2026-08-25 | 53 articles, 4 CVEs, 7 breaches | The threat landscape today is defined by aggressive exploitation of critical infrastructure vulnerabilities and a sophisticated multi-vector malware distribution campaign. ClearFake Operators are leveraging abused legitimate services to... |
| 2026-08-24 | 50 articles, 3 CVEs, 4 breaches | Russian state-sponsored espionage actors are conducting a coordinated campaign leveraging multiple advanced tactics to target high-value individuals in the US and Europe. This activity involves active exploitation of a critical Zimbra... |
| 2026-08-23 | 3 articles, 0 CVEs, 1 breaches | ToxicPanda Android malware continues to expand its capabilities by leveraging VPN permissions to obstruct Google Play services, thereby evading detection mechanisms. This sophisticated evasion technique allows the threat actor to target a... |
| 2026-08-22 | 6 articles, 0 CVEs, 2 breaches | A significant cluster of mobile malware activity is currently targeting financial institutions across multiple regions. Operators behind Manic, Grandoreiro, and ToxicPanda 2.0 are deploying sophisticated banking trojans with spyware... |
| 2026-08-21 | 45 articles, 3 CVEs, 6 breaches | A critical zero-day vulnerability in Microsoft Entra ID, tracked as CVE-2026-69836, is being actively exploited by an unidentified adversary to achieve remote code execution within cloud identity infrastructure. The high severity and... |
| 2026-08-20 | 81 articles, 27 CVEs, 2 breaches | A coordinated Russian cyber espionage campaign involving clusters linked to ICE RELIC, UNC6293, and UNC7005 is actively targeting high-value individuals in defense, government, and academia. These actors are employing sophisticated social... |
| 2026-08-19 | 58 articles, 8 CVEs, 8 breaches | A major US Department of Justice indictment has charged seventeen Iranian nationals linked to Mabna Institute and the Islamic Revolutionary Guard Corps. These actors are accused of orchestrating a sprawling cyber espionage campaign that... |
| 2026-08-18 | 48 articles, 10 CVEs, 5 breaches | The threat landscape today is dominated by active exploitation of critical infrastructure flaws, with a particular focus on VMware vCenter and GitLab environments. Attackers are leveraging the critical directory traversal vulnerability in... |
| 2026-08-17 | 42 articles, 6 CVEs, 11 breaches | A coordinated cluster of Linux-based IoT botnets, including Evooo1Bot and Mirai variants, is actively exploiting router vulnerabilities to establish SOCKS5 proxy networks. This activity represents a significant shift in threat actor... |
| 2026-08-16 | 8 articles, 0 CVEs, 4 breaches | The threat landscape today is defined by a diverse array of targeted operations against financial, infrastructure, and governmental sectors. A significant data breach has compromised customer order details from cryptocurrency hardware... |
| 2026-08-15 | 5 articles, 0 CVEs, 2 breaches | The threat landscape today is dominated by the rapid proliferation of Evooo1Bot, a sophisticated Mirai variant that converts compromised routers into stealthy SOCKS5 relay nodes. This modular Linux-based malware enables widespread network... |
| 2026-08-14 | 41 articles, 8 CVEs, 10 breaches | A coordinated financial crime syndicate operating across Brazil and Europe has been dismantled following arrests linked to an €30 million fraud against Commerzbank. This incident highlights the persistent risk of supply chain compromises... |
| 2026-08-13 | 40 articles, 3 CVEs, 6 breaches | Critical infrastructure and enterprise environments face simultaneous pressure from actively exploited zero-day vulnerabilities and sophisticated ransomware operations. VMware vCenter, Microsoft SharePoint, and Adobe Commerce are currently... |
| 2026-08-12 | 90 articles, 46 CVEs, 6 breaches | The threat landscape on August 12, 2026, is dominated by a sophisticated dual-threat campaign linking the North Korean Lazarus Group with the financially motivated Gunra ransomware syndicate. This collaboration highlights a deepening... |
| 2026-08-11 | 756 articles, 696 CVEs, 4 breaches | The current threat landscape is defined by two concurrent high-severity operational clusters. DeadLock ransomware has integrated Polygon smart contracts and the Session messaging network to decentralize its extortion infrastructure... |
| 2026-08-10 | 57 articles, 6 CVEs, 5 breaches | A China-linked ransomware group known as Storm-1175 has launched a new campaign utilizing StormEncryptor, exploiting authentication bypass vulnerabilities in N-central to deploy malware rapidly across enterprise networks. Concurrently... |
| 2026-08-09 | 39 articles, 36 CVEs, 2 breaches | Today’s threat landscape is defined by a significant convergence of sophisticated ransomware tactics and critical infrastructure vulnerabilities. The ShinyHunters extortion group has intensified operations, targeting major healthcare... |
| 2026-08-08 | 18 articles, 9 CVEs, 4 breaches | Municipal infrastructure faced significant operational disruption today as both the City of Suisun and the City of Coweta suffered cyber incidents. The City of Suisun declared a local emergency after malicious software disabled its 911... |
| 2026-08-07 | 55 articles, 11 CVEs, 11 breaches | The threat landscape today is defined by sophisticated social engineering campaigns and high-profile legal resolutions in the cybercrime space. The extortion group UNC6671, formerly known as BlackFile, is actively pivoting its tactics from... |
| 2026-08-06 | 69 articles, 22 CVEs, 7 breaches | The threat landscape today is dominated by significant legal conclusions regarding major cybercrime campaigns alongside active, sophisticated supply chain attacks. The sentencing of Ransom Cartel architect Maksim Silnikau and the guilty... |
| 2026-08-05 | 48 articles, 4 CVEs, 7 breaches | Active exploitation of IBM Langflow is intensifying, prompting CISA to add the related CVE-2026-9198 to its KEV catalog today. The vulnerability enables unauthenticated remote code execution by chaining an auto-login endpoint with a code... |