Provenance attestations prove where an npm package was built, not who was at the keyboard when it was published, which is why a hijacked maintainer account can still push credential-stealing releases through a fully verified pipeline.
Cisco's Catalyst SD-WAN authentication-bypass zero-day (CVE-2026-76504) and a critical FortiMail flaw are both under active exploitation, exposing why internet-facing appliance patching, detection, and compensating controls keep trailing attackers.
An autonomous AI agent chained Zammad zero-days to seize control of cybersecurity nonprofit DIVD's systems in seconds, exposing the growing gap between AI-speed exploitation and the root flaw that remains unpatched.
Apple's out-of-band fix for CVE-2026-86950, a CoreGraphics image and font decoding zero-day exploited in extremely sophisticated targeted spyware-style attacks, exposes why media parsing remains a durable remote attack surface and why older devices frequently sit in a patch gap.
ShinyHunters is exploiting Oracle PeopleSoft CVE-2026-35273 by slipping past WAF protections and dropping web shells, a reminder that edge filtering alone cannot contain post-exploitation tradecraft when patching lags.
A primitive-by-primitive teardown of why hooking WriteProcessMemory is a brittle foundation for injection detection, covering the alternative memory-write APIs and syscall paths implants actually use plus the ETW, call-stack, and cross-process handle telemetry that keeps working when the hooked…
A detection-engineering walkthrough of the actively exploited Citrix NetScaler zero-day RCE vulnerabilities that watchTowr uncovered, mapping the attack chain from initial exploit to post-exploitation and giving defenders concrete detection logic and mitigations to apply while no patch exists.
A technical anatomy of the first self-propagating supply-chain worm to target AI agent memory infrastructure through malicious npm and PyPI packages, explaining how it spreads and what defensive controls matter.
A hands-on guide to building a Node.js triage script that fingerprints vulnerable WordPress installs, applies virtual patching for CVE-2026-87902, and hunts for post-exploitation webshells after attackers began exploiting the critical RCE within hours of the patch release.
A comparative breakdown of the actively exploited pre-authentication RCE flaws in F5 BIG-IP APM (CVE-2026-94127), Check Point Security Gateway, and Arista VeloCloud Orchestrator, covering data-plane versus management-plane exploit paths, exposure checks, IOC hunting, and patch sequencing.
GHAPPIER abused npm trusted publishing and GitHub Actions OIDC workflows to compromise 65 repositories and push a malicious loader through a poisoned package, exposing how CI/CD trust can be turned into an attack surface.
The Meta Muse zero-day on macOS shows how a hijacked AI agent tool-execution path can turn into malware injection, so this post walks through auditing agent permissions, tool scopes, signed tool calls, and update channels before the next one lands.
A technical breakdown of the Meta Muse zero-day that let attackers hijack the agent's tool calls and inject malware, and what the incident reveals about prompt injection as a real attack surface in production AI agents.
A hands-on audit guide for server-side JavaScript teams that decode HEIF uploads, using the HEIF Heist RCE chain across Meta, Slack, and GitHub Enterprise as the case study for hardening every image-parsing path in a Node.js stack.
The WaterPlum campaign turned fake coding tests into a supply-chain attack vector, infecting roughly 30,000 developer machines with persistent RATs while siphoning $10.7 million in crypto, and it exposes how casually most teams execute untrusted code from job candidates.
BragJack exposes how missing sender validation in the message bridges between browser extensions and AI agent APIs lets a single malicious extension hijack assistants across five major browsers without any user interaction.
Ephemeral CI runners hide vulnerable kernels behind short-lived hosts, so this post maps the actively exploited Linux kernel flaws and the Copy Fail root-escalation bug to CI and cloud workloads and lays out a practical kernel patch-triage checklist.
A fake LastPass download campaign abused GitHub's trusted reputation and poisoned Google search results to deliver the Rapuncel password-stealing malware to developer machines, exposing how brittle repository-based trust signals really are.
A critical Docker Sandboxes vulnerability let malicious guest code running inside a container read and modify files on the macOS host, a reminder that local and CI containers should not be treated as trusted security boundaries.
A technical teardown of how attackers turned Brevo's trusted marketing script into a ClickFix dropper served across 100,000+ customer websites, plus what web teams can do to govern third-party JavaScript.
Acronis has patched a vulnerability in its cPanel and Plesk backup plugin that was exploited in targeted attacks, leaving shared-hosting providers to inventory affected servers, apply the fix, and hunt for post-exploitation persistence.
A pre-auth SQL injection zero-day in Cisco Secure Email Gateway let attackers turn crafted emails into root-level command execution, prompting Cisco to ship fixes and mitigations while defenders scramble to detect anomalous gateway behavior.
A technical teardown of the KREMLIN banking trojan's malicious Chrome extension, examining how it abused extension permissions, manipulated declarativeNetRequest rules, and leveraged native messaging to infect over 1,500 systems, along with detection guidance for enterprises.
A practical guide to auditing WordPress and WooCommerce sites for plugin patch lag and uncovering post-compromise indicators after active exploitation of critical plugin flaws.