Threat Intelligence
Actionable intelligence on APT groups, zero-days, malware variants, and emerging TTPs. Stay informed with global situational awareness.
THREAT RISK INDEX
Build a focused threat report
Choose a standard report, narrow it to a topic or CVE, and review the cited sources.
Recent Intelligence Reports
Curated threat reporting from Dark Reading and The Hacker News, refreshed daily.
Severity Distribution
Grouped by headline keywords, not a vendor score
- CRITICAL
- HIGH
- LOW
Webinar: See How Identity Blind Spots Put Your SOC at Risk and How to Close Them
Security teams have more alerts, logs, and monitoring tools than ever. Yet when an attack happens, one simple question can still take too long to ans…
ThreatsDay: 59 Linux Kernel Bugs, Falcon Spyware, GSocket Backdoors + 17 More Stories
A search result isn't always safe. An access request isn't always harmless. And a familiar account doesn't always mean a familiar person is using it.…
New SignDrop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access
Public exploit code released earlier this week claims that a local Windows user can gain SYSTEM privileges through the Common Log File System driver.…
Critical Red Hat Quay Flaw Lets Attackers Read and Overwrite All Private Container Images in a Registry
A critical flaw in Red Hat Quay allows an attacker who can access a Quay registry to read and overwrite private container images in every repository.…
Citrix Patches 12 NetScaler and Secure Access Client Flaws, Including Authentication Bypass
Citrix has released patches for multiple critical security flaws impacting NetScaler ADC, Citrix NetScaler Gateway, and NetScaler Console that could…
186 Fake AI Domains Redirect Users to ClickFix Lures, Browser Malware, and Search Hijackers
Cybersecurity researchers have found that lookalike domains masquerading as artificial intelligence (AI) tools are being used to serve ClickFix-style…
SCKit Malware Turns ScreenConnect Support Sessions Into Potential MSP Attack Paths
The ongoing campaign targeting ConnectWise ScreenConnect deployments involves the exploitation of a now-patched critical security flaw in the remote…
Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs
Google Cloud VMs on AMD Turin chips need a guest OS patch and a stop-and-start to protect against three CPU side-channel flaws, Google said this week…
New N-central Exploits Work Against Patched Servers, Enable Root RCE and Windows SYSTEM Access
N-able on Thursday said it's investigating a new public disclosure containing claims of additional vulnerabilities in on-premise versions of N-centra…
Calendar Invites and Live Proxies: Inside a Google Session Hijacking Campaign
Since mid-August 2026, a phishing operation has been stealing live Google sessions from corporate users. Every check defenders normally lean on to ju…
PTC Patches Critical Windchill and FlexPLM Flaw That Could Enable Remote Code Execution
PTC has released patches for a new critical vulnerability impacting Windchill and FlexPLM software that, if successfully exploited, could result in r…
Inside an AI Attack Against a US Retailer
When hand-typed commands failed to breach a US retailer, the attacker turned to AI-generated scripts, achieving lateral movement in minutes.
Critical Pre-Auth MongoDB Flaw (CVE-2026-118383) Can Crash Lagging Servers on Failover
A critical flaw in MongoDB Server allows an unauthenticated attacker to send two requests that trigger a crash on the database server. The crash occu…
Node.js Fixes 16 Flaws, Including HTTP/2 Bugs That Crash Servers and Leak Other Connections' Data
A flaw fixed in Node.js this week lets unauthenticated clients crash servers that use the runtime's built-in HTTP/2 support on the 24.x and 26.x rele…
Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories
Starting Tuesday, an attacker used stolen credentials for 4,837 GitHub accounts to plant a secret stealer in repositories those accounts could write…
Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely
A critical flaw in Apache HTTP Server's HTTP/2 module, mod_http2, can let a remote attacker run code on the server. Tracked as CVE-2026-119618, it af…
ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients
ConnectWise has taken the precautionary step of disabling five third-party extensions in partner environments following reports of unauthorized acces…
Chinese AI Project Scouts Spies in Taiwan Chip Industry
The CCP built a Big Data system to scrape reams of information and learn about individuals abroad, to potentially target and exploit them. Think Alic…
Japan Pushes Emergency Funding for Cybersecurity as AI-Assisted Breaches Rise
The package adds public-private cyber responders, an AI-focused team run by the economic ministry, and more leeway to use the government's new active…
Attackers Say 'Hello' to a Different Scale of Cloud Attack
Researchers dubbed an attack chain "Greeter" after discovering that attackers deliberately covered their trail by leaving "hello" messages in logs.
AI Raises the Stakes for Cyber Resilience
An organization's ability to quickly recover from a business disruption will be a competitive advantage in an era of AI-driven threats and business e…
N-able Takes N-central Platform Offline After Discovery of 33 Flaws
The RMM provider also released a hotfix as a recommended mitigation to address public exploits for the alleged zero-days, which allow for attacker ta…
Critical Zoom Workplace Flaw Could Allow Unauthenticated Remote Privilege Escalation
Zoom has released software updates to address two security flaws impacting Zoom Workplace for Windows, including a critical bug that could result in…
AntiFox AI Pentesting Platform Linked to Attacks That Accessed AWS Production Secrets
Cybersecurity researchers have disclosed details of a campaign in which an emerging agentic penetration testing platform called AntiFox has been used…
Hackers Target Qlik Sense Servers With Reverse Shells, Stage ActiveMQ and Veeam Exploits
Threat actors have been observed targeting Qlik Sense servers to unsuccessfully deliver PowerShell reverse shell commands against multiple environmen…
Over 35,000 Grok-Built Apps Exposed Online, Some Leaking Confidential Data and Passwords
Of the 37,571 Grok-built apps that security company Claroc found online, 35,578 were open to anyone without a sign-in, the researchers said yesterday…
November Patch Tuesday: An Overflowing Cornucopia of CVEs
Microsoft serves up an actively exploited Outlook zero-day, and a wave of critical Exchange, SharePoint, Windows Search, and LDAP bugs that exhausted…
Artex: The AI Pen-Test Tool Hackers Turned Into a Weapon
Forks of the open source Artex framework, along with 45 similar pen-testing tools, remain capable of executing credential attacks and cloud breaches…
F-Secure Identifies 26 Ways AI Can Harm Consumers, and Where to Stop Them
New AI Harms Taxonomy traces how harm moves through AI systems, from misleading chatbot answers to compromised autonomous agents, and identifies wher…
Checkmarx Appoints Kobi Sivilya as Chief Information Security Officer
Sivilya brings deep cybersecurity and technology leadership to Checkmarx as AI transforms software development.
How to Assess OT Incident Response Preparedness
Cloud Range's free 28-question OT Cyber Readiness Assessment helps organizations identify gaps in operational technology (OT) incident response.
AI Coding Agents Leak Thousands of Secrets to GitHub
A command in Claude Code inadvertently saves files with credentials and other sensitive data to public Git repositories, creating security gaps for o…
AI Makes Reverse Engineering Mainstream Software & Malware Far Easier
Researchers unpacked, mapped, and recreated complex software and the Turla malware, raising opportunities and concerns for organizations and cybersec…
People Are Getting Weird About AI
Dark Reading Confidential Episode 22: You can love AI without being blind to cybersecurity being sacrificed for utility. The tendency for humans to a…
CISA Announces Enhanced Reporting Form for Cyber Incidents
New questionnaire captures critical data and information that improves the agency’s ability to assess incidents, identify trends and prioritize respo…
Microsoft Fixes RCE Bug in Windows Paint After Weeks of Confusion
Last month, Microsoft disclosed a vulnerability in Microsoft Paint, but messaging regarding a patch was unclear.
Black Hat India 2026 Makes a Landmark Debut in Bengaluru, Bringing the Global Cybersecurity Community to India
Inaugural edition by Informa Markets in India brings together leading researchers, security practitioners and industry decision makers for four days…
Attackers Crash Claude's 'Office Party' Flaw to Run Malicious Code on Linux
Attackers can exploit a flaw in Claude's document-processing tool by creating a temporary file that Anthropic's AI assistant can access and run on a…
PwC's CISO on AI, Robots & What's Next for Security
As AI accelerates change across the enterprise, PwC's James Shira explains why security teams must rethink their approach to risk and adapt their str…
Secure The Intelligence
Join the priority transmission list. Direct briefings on Breaches, M&A, AI, and Quantum shifts. Zero noise.