Intelligence · Updated daily

Security Intelligence

AI-analysed threats, vulnerabilities and campaigns. Not just what happened — what it means, who's affected, and what to do about it.

RSS feedCVE index632 entries
VulnerabilitiesMalwareCampaignsSupply ChainPolicyTools

Page 17 of 26

401–425 of 632
highVulnerabilityEmerging

Schneider Electric DCE Hard-Coded Credentials Enable Authenticated RCE in Critical Infrastructure Monitoring

Schneider Electric's EcoStruxure Data Center Expert contains hard-coded credentials that, combined with an optional SOCKS proxy feature, allow authenticated attackers to compromise the monitoring platform. This threatens visibility and control of critical data center infrastructure.

Schneider Electric EcoStruxure IT Data Center Expert ≤9.0, Schneider Electric EcoStruxure IT Data Center Expert 9.1
criticalPolicyActive

Microsoft Exchange Online servicewide outage reveals continued reliability concerns in critical communication infrastructure

Microsoft Exchange Online experienced a widespread outage blocking mailbox and calendar access for customers globally. This incident underscores the operational risks of cloud-based email dependencies and the cascading business impact when a single provider experiences infrastructure failures.

Microsoft Exchange Online, Microsoft 365 subscribers
criticalCampaignContained

Destructive Microsoft Entra-based attack on Stryker demonstrates cloud identity compromise as primary attack vector for device-level destruction

Stryker suffered a destructive cyberattack that remotely wiped tens of thousands of employee devices through compromised Microsoft cloud credentials, requiring no malware payload and leveraging legitimate administrative access to cloud infrastructure.

Stryker Corporation, Microsoft Entra (Azure AD), Intune or similar MDM platforms
informationalPolicyEmerging

Android 17 Accessibility API Restrictions: Proactive Defense Against Malware Abuse of System Privileges

Google is implementing API restrictions in Android 17 to prevent non-accessibility apps from abusing the accessibility services API, a common malware technique for achieving privileged operations without proper permissions. This is a preventive security hardening measure rather than a response to active exploitation.

Android 17, Android Advanced Protection Mode (AAPM)
criticalSupply ChainActive

GlassWorm Supply-Chain Escalation: Transitive Dependency Injection via Open VSX Registry

GlassWorm threat actors are exploiting extensionPack and extensionDependencies features in Open VSX to achieve transitive malware propagation across 72+ extensions, significantly improving attack efficiency and evading detection. This represents a watershed moment in IDE-based supply-chain attacks targeting developer environments.

Open VSX Registry, Visual Studio Code Community, Open VSX Extension Developers +1
highCampaignContained

Opportunistic Probing of Critical Infrastructure: Poland's Nuclear Research Centre Targeted in Broader Campaign

Poland's National Centre for Nuclear Research (NCBJ) was targeted by cyberattackers who attempted to compromise its IT infrastructure, but intrusion detection systems successfully identified and blocked the attack before any material impact occurred. This incident underscores persistent adversarial interest in critical infrastructure sectors, particularly those with strategic national importance.

National Centre for Nuclear Research (NCBJ), Polish Critical Infrastructure