Intelligence · Updated daily
AI-analysed threats, vulnerabilities and campaigns. Not just what happened — what it means, who's affected, and what to do about it.
Fairlife, a $1 billion+ dairy company, suspended US production across three states following a cyber incident. The outage highlights how food manufacturers remain exposed to operational disruption despite their role in critical infrastructure.
Abbott Laboratories is investigating two concurrent cybersecurity incidents: unauthorised access to legacy Exact Sciences systems in its Cancer Diagnostics division and a separate breach of its LabCentral portal with alleged data theft. The incidents highlight vulnerabilities in healthcare IT infrastructure spanning both legacy systems and modern cloud platforms.
A path normalization flaw in Envoy Gateway's Lua security validation allows attackers to bypass authentication checks and read sensitive files (Kubernetes tokens, TLS certs, environment variables) from gateway controller pods by submitting malicious EnvoyExtensionPolicy objects.
Pheditor ships with a hardcoded SHA-512 hashed default password ('admin') with no forced change mechanism, granting unauthenticated attackers immediate RCE and arbitrary file access on any unpatched deployment. This is a trivial pre-authentication compromise vector affecting all versions.
Cisco Talos has published a teaser article announcing a significant coordinated patching event, but the source material provides insufficient technical detail to assess specific vulnerabilities or their impact. The framing suggests multiple vendors may be releasing patches simultaneously.
SecurityWeek examines the structural tension in operational technology security where legacy systems, safety dependencies, and critical infrastructure protection create barriers to standard vulnerability disclosure practices. The piece highlights how OT environments differ fundamentally from IT, complicating the security research and patching ecosystem.
Two members of the Scattered Spider cybercriminal group, Owen Flowers (18) and Thalha Jubair (20), received 5.5-year sentences for orchestrating a 2024 ransomware attack against Transport for London that disabled 148 systems and forced 27,000 employees to reset credentials in person. The sentencing marks a significant law enforcement victory but group's capacity to cause infrastructure-level disruption.
Senator Ron Wyden opposes Canada's proposed lawful access legislation, arguing it would repurpose US technology infrastructure for surveillance and set a dangerous precedent. The dispute reflects ongoing tensions within the Five Eyes alliance over encryption backdoors and government access capabilities.
ClickLock is a new macOS information-stealer that terminates all visible processes to coerce users into entering their system login password, bypassing normal user friction and capturing credentials before defenders can respond.
Unit 42 documents an escalation in npm ecosystem attacks post-Shai Hulud, shifting from simple malware injection to wormable payloads and CI/CD persistence mechanisms. This represents a maturation of supply chain targeting beyond initial compromise.
Cursor, an AI-powered code editor, automatically executes a git.exe binary from the project root without validation, allowing attackers to achieve arbitrary code execution by distributing malicious repositories. This is particularly concerning given Cursor's access to sensitive development environments and integration with build pipelines.
Researchers discovered TuxBot v3 Evolution, an IoT botnet framework apparently developed with LLM assistance, revealing that while AI can generate functional malware code, poor operational security by developers (ignoring safety disclaimers) remains a limiting factor in threat sophistication.
The Trump administration has launched Gold Eagle, a clearinghouse programme that uses artificial intelligence to help industry and government detect, prioritise and remediate cybersecurity vulnerabilities at scale. This represents a significant policy shift toward centralised vulnerability intelligence sharing.
Dutch law enforcement arrested multiple individuals operating an international investment fraud ring that defrauded tens of thousands of victims of over €100 million. The case highlights the persistence of large-scale financial fraud operations and the challenges in prosecuting cross-border criminal networks.
Authenticated users can bypass file upload restrictions in FacturaScripts by injecting `../` sequences into client-supplied filenames, enabling arbitrary file writes outside the intended `MyFiles/` directory. Combined with `.htaccess` exclusion bypass, this escalates to remote code execution via executable file placement in web-accessible directories.
Automated Frequency Coordination systems for 6 GHz Wi-Fi accept client-supplied location data without proper validation, allowing attackers to spoof their position and disrupt spectrum access for legitimate users and critical infrastructure.
Microsoft released 570 security patches in a single Patch Tuesday cycle, triple the previous month's record, with the vendor attributing the surge to artificial intelligence-aided vulnerability discovery. This represents a significant shift in patch cadence and raises questions about remediation capacity across enterprise environments.
Microsoft released 622 security patches in a single update, triple the previous monthly high, including at least two zero-day vulnerabilities currently under active attack. Immediate patching is essential for organisations running Microsoft products.
The US Department of Justice has unsealed charges against alleged operators of Media Land and ML Cloud, St. Petersburg-based companies accused of providing hosting infrastructure and technical support specifically to cybercriminals. This represents a significant enforcement action targeting the operational backbone of organised cybercrime.
SonicWall disclosed two zero-day remote code execution vulnerabilities in SMA1000 appliances (CVE-2026-15409 and CVE-2026-15410) that are already being exploited in the wild. Organisations running these secure access appliances must apply patches immediately to prevent authenticated attacker access.
Authenticated SQL injection in FacturaScripts REST API filter parameter allows scoped API keys with minimal privileges to extract sensitive data (password hashes, session cookies) and achieve account takeover. The vulnerability bypasses identifier escaping through parenthesis-containing field names.
Anyquery's server mode fails to restrict SQLite's ATTACH DATABASE command, allowing unauthenticated remote attackers to write arbitrary files to any filesystem location the process can access, directly enabling code execution via web shells, SSH key injection, or cron job manipulation.
Authenticated tenants in multi-tenant HTTP n8n-MCP deployments can access, modify, or delete other tenants' workflow version backups, exposing credential references and authorization headers. Patch 2.56.1 isolates backup storage per tenant.
Cisco Talos has published promotional content on their threat intelligence integration capabilities, positioning their feeds as a mechanism for converting raw threat data into actionable defences across Cisco product ecosystems.
Microsoft released patches for 622 vulnerabilities in a single cycle, including two zero-days already exploited in the wild affecting Active Directory and SharePoint Server, plus a publicly disclosed BitLocker flaw. The scale and active exploitation indicate broad attack surface across enterprise authentication and document collaboration infrastructure.