Cybersecurity, AI, etc.
Red teaming (offensive research, new TTPs, exploitation techniques, PoC releases, adversary simulation findings)
CISA has added CVE-2026-76504, a critical authentication-bypass vulnerability in Cisco Catalyst SD-WAN Manager, to its Known Exploited Vulnerabilities catalog after reports of active exploitation. Cisco says the issue can allow…
Fortinet has warned that CVE-2026-104286, a critical FortiMail vulnerability, is being exploited in the wild. The flaw can let an unauthenticated attacker write arbitrary files on an affected system through…
Threat hunters have reported post-exploitation activity against Citrix NetScaler ADC and Gateway systems that includes attacker-created superuser accounts and web shells mapped to paths resembling CSS resources. The activity follows…
A public proof-of-concept has been released for CVE-2026-86950, an Apple CoreGraphics vulnerability that Apple says may have been used in highly targeted attacks. The research demonstrates a crash triggered by…
European law-enforcement agencies have arrested three people in an operation targeting the KillSec ransomware group, including a 16-year-old in Spain whom investigators suspect was the group’s main operator. Authorities also…
Threat actors are abusing ChatGPT Custom GPTs to make malicious destinations look like legitimate AI product offerings, according to reporting based on Huntress research. The campaign directs victims to a…
Cisco’s Catalyst SD-WAN Manager is affected by CVE-2026-76504, a critical API authentication-bypass vulnerability that Cisco says has been exploited in the wild. Rapid7 reports that the flaw has a CVSS…
Citrix has warned that exploitation of CVE-2026-88771 and CVE-2026-88772 has been observed on unmitigated NetScaler deployments. The vendor’s security bulletin covers multiple NetScaler ADC and Gateway vulnerabilities, with the two…
Microsoft published new tracking guidance for CVE-2026-73570, an unauthenticated command-injection vulnerability affecting internet-facing mail servers. The advisory underscores a familiar but high-impact operational risk: exposed infrastructure can move quickly from…
Microsoft says the Russian state threat actor it tracks as Star Blizzard has expanded its operational playbook with large-scale phishing, compromised-website accounts, and a malware-delivery technique it calls RedFlick. Microsoft…