Intelligence · Updated daily

Security Intelligence

AI-analysed threats, vulnerabilities and campaigns. Not just what happened — what it means, who's affected, and what to do about it.

RSS feedCVE index879 entries

Vulnerabilities Malware Campaigns Supply Chain Policy Tools

Priority

highVulnerabilityActive

ESAFENET CDG document management system targeted by login-bypass scanners following public XSS disclosure

Internet-wide scanning activity has been observed against ESAFENET's CDG document management platform, exploiting known weaknesses including default credentials, SQL injection, and cross-site scripting. The product, popular in Chinese markets, exhibits preventable authentication and input validation flaws despite being marketed as a secure data leakage prevention solution.

27 July 2026ESAFENET CDG (Content Data Guard)

highCampaignActive

PEAR Ransomware Exfiltrates 3TB from Medical Billing Firm, Exposing 1.2M Patient Records

The PEAR ransomware group claimed responsibility for stealing 3TB of data from MCBS, a medical business management company, affecting approximately 1.2 million individuals. This incident highlights the targeting of healthcare administrative infrastructure as a revenue source for organised ransomware operations.

27 July 2026MCBS (Medical Business Management Company)

criticalVulnerabilityActive

Fastjson 1.x RCE in Active Exploitation with No Patch Available

Attackers are exploiting CVE-2026-16723, an unauthenticated remote code execution flaw in Fastjson 1.x, against Spring Boot applications with no patch currently available from Alibaba. The vulnerability allows arbitrary code execution with Java process privileges.

CVE-2026-16723

26 July 2026Fastjson 1.x, Spring Boot applications using Fastjson

highCampaignActive

In-Memory Malware Assembly via Malvertising: Fileless Attack Pattern Exploiting Trusted Platforms

A malvertising campaign targets users of financial and cryptocurrency platforms by hosting fake login pages that use JavaScript to assemble and execute malware directly in browser memory, bypassing traditional file-based detection mechanisms.

26 July 2026Solana, Luno, TradingView +1

highVulnerabilityEmerging

Rockwell Arena Simulation RCE Vulnerabilities Expose Industrial Control Networks

Rockwell Automation has released patches for code execution flaws in Arena simulation software that could allow attackers to compromise industrial organisations. The vulnerabilities are particularly concerning given Arena's role in critical infrastructure modelling and design.

26 July 2026Rockwell Automation Arena Simulation Software

highCampaignActive

SourTrade malvertising campaign uses fragmented payloads and Bun runtime to evade detection

SourTrade, a malvertising operation active since late 2024, distributes Windows malware in fragments across browser sessions, reassembling executables client-side using the legitimate Bun JavaScript runtime to bypass static URL-based detection. The campaign impersonates trading platforms to target retail traders.

26 July 2026Windows, TradingView (impersonated), Solana (impersonated) +1

All intelligence

Showing 19 of 879

mediumSupply ChainActive

GitHub and PyPI implement temporal dependency verification to raise the cost of supply-chain package injection

GitHub and PyPI have added time-based verification mechanisms to Dependabot that detect when dependency updates deviate from expected release patterns, making it harder for attackers to inject malicious package versions into popular projects.

27 July 2026PyPI, GitHub, Dependabot

highMalwareActive

ClickFix Trojan Leverages Steam Community Forums to Deploy XMRig Cryptominers at Scale

Threat actors are posting fake technical support threads on Steam discussion forums linking to ClickFix malware, which executes XMRig cryptocurrency miners on victim systems. The attack exploits the high trust and technical audience of Steam's community to achieve broad distribution among gamers.

26 July 2026Steam, Windows gamers

criticalVulnerabilityActive

Cryptographic Fallback to Non-CSPRNG in sm-crypto: Node.js SM2 Key Generation Predictability

sm-crypto 0.4.0 falls back to Math.random() + wall-clock seeding for SM2 private key generation on Node.js because jsbn's SecureRandom checks window.crypto instead of globalThis.crypto. This renders all default SM2 keys cryptographically predictable.

25 July 2026sm-crypto/0.4.0, jsbn/1.1.0

criticalVulnerabilityActive

Pheditor: Unauthenticated Password Reset via Missing Current Password Verification

Pheditor's forced password-change flow fails to verify the current password when the default admin password is unchanged, allowing unauthenticated attackers to set an arbitrary password and obtain a valid authenticated session.

25 July 2026pheditor (all versions with this flaw)

highPolicyActive

Board-CISO Communication Breakdown: Governance Risk in Strategic Security Alignment

Boards and CISOs report persistent communication gaps despite increased threat awareness forcing security up the priority agenda. Misalignment between executive expectations and security team capabilities creates governance and operational risk.

25 July 2026

highVulnerabilityEmerging

Aggregated threat briefing reveals convergence of AI-powered malware, industrial vulnerabilities, and kernel flaws across multiple attack vectors

SecurityWeek's aggregate report covers multiple concurrent threats including Dolphin X AI-assisted malware, Siemens industrial switch vulnerabilities, a Russian Zimbra campaign, Linux kernel flaws, and ransomware extortion attempts. The breadth suggests attackers are expanding their targeting across consumer, industrial, and infrastructure domains simultaneously.

25 July 2026Siemens ROX II, Linux kernel, Zimbra webmail +2

highCampaignActive

BlueNoroff Operationalises Crypto-Targeted Phishing Through Compromised Industry Contacts and Typosquatted Domains

North Korean threat actor BlueNoroff is running a sophisticated phishing campaign that impersonates Zoom and Microsoft Teams via typosquatted domains to profile cryptocurrency wallet holders before delivering malware. The operation combines trusted industry contact compromise with social engineering to increase success rates.

25 July 2026Zoom, Microsoft Teams, Cryptocurrency wallet users

informationalPolicyActive

UK Cyber Policy Continuity Under Labour: Strategic Retention of Lloyd Signals Institutional Stability

The UK's new Prime Minister Keir Starmer has retained Liz Lloyd in a cyber policy role despite dissolving her previous ministry, indicating continuity in national cyber governance rather than substantive policy change. This retention of a key Starmer ally in a reduced capacity suggests cyber remains a government priority whilst undergoing organisational restructuring.

25 July 2026

highSupply ChainActive

OnTrac supply chain breach exposes parcel delivery network to customer data theft

OnTrac, a major US parcel delivery provider, suffered a network breach allowing attackers to access customer personal data. This represents a significant supply chain risk affecting businesses and individuals relying on the carrier.

25 July 2026OnTrac

highVulnerabilityActive

Auth.js Email Normalizer Unicode Homoglyph Bypass – Validate-Before-Canonicalize Logic Flaw

Auth.js email normalizer validates email addresses before applying Unicode normalization, allowing attackers to bypass the single-@-symbol check using Unicode homoglyphs that canonicalize to @. This enables account takeover via magic-link misdirection to attacker-controlled addresses.

24 July 2026next-auth/4.0.0 through 4.24.13, @auth/core/0.1.0 through 0.41.2

highPolicyActive

Patch prioritisation over patch coverage: Q2 2026 threat landscape shows diminishing returns on blanket remediation

Cisco Talos analysis of Q2 2026 vulnerability statistics reveals a saturation point in patch management where organisations attempting to remediate everything face resource exhaustion and reduced security outcomes. Intelligent triage and risk-based patching now outperforms comprehensive patch deployment.

24 July 2026Enterprise organisations, IT operations teams

highCampaignActive

Origin Energy breach exposes 2M Australian customers amid critical infrastructure targeting trend

Attackers have compromised Origin Energy, Australia's largest energy retailer, and exfiltrated personal data on approximately 2 million customers. The breach targets critical infrastructure and demonstrates ongoing vulnerability in essential services.

24 July 2026Origin Energy

criticalCampaignActive

Russian state group weaponised Zimbra zero-day for systematic email and 2FA exfiltration

A Russian espionage group exploited an unknown flaw in Zimbra webmail to harvest email, directory data, and 2FA recovery codes from Western organisations over an extended period. The attack required only message open to trigger payload execution.

24 July 2026Zimbra webmail

highCampaignActive

Laundry Bear's zero-click Zimbra campaign signals shift toward webmail-focused supply-chain targeting

Russia-linked Laundry Bear has deployed zero-click phishing attacks against Zimbra webmail users globally, exploiting the platform's ubiquity in enterprise and government environments to establish initial access for credential harvesting and lateral movement.

24 July 2026Zimbra Collaboration Suite, Zimbra webmail users (global)

highMalwareEmerging

Dolphin X RAT introduces AI-driven victim prioritisation to optimise attack ROI

Dolphin X, a new remote access trojan, incorporates machine learning to profile and rank infected hosts by value, enabling attackers to concentrate resources on high-yield targets. This represents a meaningful shift toward data-driven targeting in commodity malware.

24 July 2026Windows systems, Enterprise networks

informationalToolEmerging

Frontier AI Models Struggle with Autonomous Malware Analysis When Evidence Invalidates Initial Conclusions

SentinelOne Labs benchmarked whether large frontier AI models can maintain investigative integrity during long-horizon malware analysis tasks when new evidence contradicts prior reasoning. The research highlights fundamental reliability gaps in autonomous AI-driven security analysis.

23 July 2026Frontier AI models (general category), AI-augmented malware analysis tools

criticalCampaignActive

Iranian state-sponsored actors exploit industrial control system supply chain via Siemens, Schneider Electric, and Rockwell devices

US federal agencies have published updated advisory detailing techniques used by Iranian-linked threat actors to compromise programmable logic controllers from major industrial automation vendors, with direct implications for critical infrastructure security.

23 July 2026Siemens PLCs, Schneider Electric PLCs, Rockwell Automation controllers

mediumPolicyEmerging

GitHub's Bug Bounty Rebalancing: Devaluing Public Disclosure While Consolidating Top-Tier Access

GitHub is halving public bug bounty payouts across all severity levels from 27 July 2026, capping critical findings at $10,000 whilst reserving $30,000+ rewards for an invite-only VIP programme. This creates a two-tiered incentive structure that may discourage independent researchers from public disclosure.

23 July 2026GitHub

informationalPolicyActive

CISA 2015 Information-Sharing Framework Extended by a Decade in Congressional Defence Bill

The US House of Representatives has approved a 10-year renewal of the Cybersecurity Information Sharing Act (CISA 2015) as part of the fiscal 2027 National Defence Authorisation Act. This extends protections for voluntary threat intelligence sharing between private sector organisations and government agencies.

23 July 2026US private sector organisations, CISA, US federal cybersecurity programmes