Security Articles

Daily threat intelligence and vulnerability analysis from our security team. We publish expert breakdowns of critical CVEs, active exploits, and emerging attack campaigns as they happen.

Our analysts monitor vendor advisories, CISA alerts, and underground threat activity to give you actionable guidance you can use the same day. Filter by severity below to find what matters most to your environment.

Updated July 26, 2026 — 168 published advisories, with new analysis most weekdays. Recent coverage includes the PTC Windchill FlexPLM remote code execution flaw under Clop exploitation, a Zimbra webmail cross-site scripting campaign stealing two-factor codes, Check Point SmartConsole CVE-2026-16232, the SharePoint machine-key remote code execution chain (CVE-2026-50522), and a ServiceNow AI Platform remote code execution bug. If one of these touches a system you run and you are not sure what to do next, our 24/7 staffed security operations center handles the triage for you.

All Articles Advisory Cyber Attack Data Breach Exploit Malware Threat Actor Vulnerability

Severity: All Critical High Medium Low

12 articles found

Featured Story

high

Jun 13, 2026

highCVE AdvisoryVulnerability

HIGH: Velvet Ant Backdoored Linux PAM and OpenSSH to Live in One Network for Nearly a Decade

Sygnia disclosed Operation Highland this week, a China-nexus campaign by the Velvet Ant cluster that compromised core Linux authentication on a victim network from 2016 through 2026. Nine variants of backdoored PAM modules and patched OpenSSH binaries delivered hardcoded magic-password access plus continuous credential and command logging. A parallel commodity tool called PamDOORa now sells for $900 on a Russian forum, putting the same authentication-layer tradecraft within reach of any ransomware affiliate with root.

By Danny MercerRead Full Article

critical

CVE AdvisoryVulnerability•May 29, 2026

CRITICAL: FortiClient EMS Bug CVE-2026-35616 Weaponized to Push EKZ Infostealer Across Managed Fleets

Threat actors are abusing CVE-2026-35616, a CVSS 9.1 pre-authentication API bypass in FortiClient EMS, to hijack endpoint management consoles and push the newly identified EKZ infostealer to every managed endpoint disguised as FortiEndpoint_Patch.exe. Patch to 7.4.7 immediately and hunt for indicators in EMS logs and on managed hosts.

high

CVE AdvisoryVulnerability•May 10, 2026

cPanel Drops Three More CVEs After Ransomware Fallout Including Perl Injection

cPanel and WHM shipped fixes for three CVEs on May 8 including a CVSS 8.8 Perl code injection in the create_user API that lets authenticated attackers execute arbitrary system commands. If you run cPanel, update immediately — attackers are already watching.

high

CVE AdvisoryVulnerability•Apr 29, 2026

HIGH: Storm-1175 Chains ConnectWise ScreenConnect Bugs to Drop Medusa Ransomware (CVE-2024-1708)

CISA added the two-year-old ConnectWise ScreenConnect path traversal flaw CVE-2024-1708 to its Known Exploited Vulnerabilities catalog on April 28, 2026, after China-aligned Storm-1175 was caught chaining it with the SlashAndGrab auth bypass CVE-2024-1709 to deploy Medusa ransomware through compromised MSP infrastructure. Federal agencies have until May 12 to remediate.

critical

CVE AdvisoryVulnerability•Apr 26, 2026

ArcaneDoor FIRESTARTER Backdoor Survives Every Cisco Firewall Patch

The FIRESTARTER implant from the ArcaneDoor campaign persists through Cisco ASA firmware updates on federal networks. CISA and UK NCSC issued a joint advisory with IOCs, detection signatures, and emergency mitigation steps. If you run Cisco Firepower or ASA, check your devices now.

critical

CVE AdvisoryVulnerability•Apr 25, 2026

CRITICAL: FIRESTARTER Backdoor Survives Cisco Firewall Patches in ArcaneDoor Federal Breach

CISA and the UK NCSC went public with a joint advisory on FIRESTARTER, a stealth implant tied to the UAT-4356 ArcaneDoor crew that survived firmware updates and security patches on a Cisco Firepower device inside a federal civilian agency. The malware chains CVE-2025-20333 (CVSS 9.9) and CVE-2025-20362 to gain root on Cisco ASA and FTD appliances, then hooks LINA and persists through reboots until a hard power cycle is performed.

high

CVE AdvisoryVulnerability•Apr 12, 2026

HIGH: CPUID Website Breach Spreads STX RAT Through Trojanized CPU-Z and HWMonitor Downloads

The official CPUID website was compromised for 19 hours, redirecting users to malicious downloads of CPU-Z and HWMonitor that delivered STX RAT. Over 150 victims identified across retail, manufacturing, telecom, and individual users in Brazil, Russia, and China.

critical

CVE AdvisoryVulnerability•Mar 31, 2026

CRITICAL: ChatGPT Code Execution Runtime Exposed as a Covert Data Exfiltration Channel

Check Point researchers discovered a ChatGPT vulnerability allowing silent data exfiltration via DNS queries from the code execution sandbox. Separately, BeyondTrust found a critical command injection flaw in OpenAI Codex that enabled GitHub token theft through malicious branch names.

critical

CVE AdvisoryVulnerability•Mar 25, 2026

CRITICAL: TeamPCP Supply Chain Attack Backdoors LiteLLM, Threatens 36% of Cloud Environments

TeamPCP has compromised LiteLLM, a Python package present in 36% of cloud environments. Malicious versions 1.82.7 and 1.82.8 deploy credential harvesters, Kubernetes lateral movement tools, and persistent backdoors.

high

CVE AdvisoryVulnerability•Mar 22, 2026

HIGH: DOJ Dismantles Massive IoT Botnet Network Behind Record-Breaking 31.4 Tbps DDoS Attacks

U.S. authorities dismantled four IoT botnets (AISURU, Kimwolf, JackSkid, Mossad) responsible for the largest DDoS attacks ever recorded. Over 3 million enslaved devices generated attacks exceeding 31 Tbps.

critical

CVE AdvisoryVulnerability•Mar 20, 2026

Veeam Backup Critical Flaw Lets Ransomware Gangs Delete Your L...

Critical authentication bypass in Veeam Backup & Replication allows attackers to delete backup repositories without credentials.

critical

CVE AdvisoryVulnerability•Feb 6, 2026

Microsoft Teams Vulnerability Allows Malware Delivery Through ...

A critical vulnerability in Microsoft Teams allows attackers to deliver malware through specially crafted meeting invitations.

Is Your Mobile App Secure?

Our CyberOne MobileAssess platform performs deep static analysis, source code decompilation, and runtime security testing for iOS and Android apps. From one-time assessments to year-long continuous testing, we find what surface-level scanners miss.

Learn About Mobile Pen Testing MSP Partner Program

Stay Informed

Subscribe to our newsletter and get the latest security insights delivered to your inbox.