Microsoft October Windows Server Updates Cause Exchange OWA and Mail Issues
Microsoft confirmed October 2026 Windows Server updates are causing OWA sign-in failures and mail delivery issues on some Exchange Server systems.
VPN & PrivacyThreat Intelligence Feed
-
-
Hackers Abuse Compromised ConnectWise Credential to Access Customer M365 Tenants
A compromised ConnectWise Cloud Backup credential has been used to gain unauthorized access to 173 partner and customer Microsoft 365 tenants.
Guides -
PwnEscape: Critical Linux Kernel Flaw Enables VM-to-Host Memory Leak
CVE-2026-99999, dubbed PwnEscape, lets code inside a VM read host memory. Patches are available for all supported Linux stable branches.
Threats -
The Blind Spots of Agentic Pentesting and How to Close Them
Agentic pentesting is the sharpest edge of offensive security today, but it leaves critical gaps. Here's where those blind spots are and how to address them.
Tools -
Three Teams Remotely Hack Pixel 10 at Pwn2Own Ireland 2026
Three research teams successfully exploited a fully patched Google Pixel 10 at Pwn2Own Ireland, winning a combined $562,500 in prizes.
Guides -
ARTEX AI Pentesting Tool Weaponized Against South Korean Financial Firms
An unknown threat actor used the open-source AI pentesting tool ARTEX to breach South Korean banks. A separate actor, SCARLET LOOP, was found automating account
Threats
Analysis & Guides
VPN & Privacy
Low-Cost Android Phones Ship with Firmware-Embedded Residential Proxy Malware
A malware campaign called 'Midnight Mimosa' embeds malicious code in low-cost Android firmware, enabling ad fraud and residential proxy abuse across 150+ countr
Tools
Wazza Phishkit Uses Multi-Stage Routing to Target Banking and Government
The Wazza phishkit targets banking, manufacturing, and government sectors across the US, Europe, and Australia using a multi-stage routing chain to evade detect
Tools
Fake AI Chatbot Ad Platform Uses BitB Attacks to Steal Credentials
A phishing platform impersonates AI chatbot ad products to steal credentials and MFA codes via browser-in-the-browser attacks targeting agency ad accounts.
VPN & Privacy
Windows KB5124010 Update Crashes Games and Apps Using AC-3 Audio
Microsoft confirmed KB5124010 crashes apps using AC-3 audio decoding. Legacy games, media players, and productivity apps are most affected.
Threats
OpenAI Disrupts Coordinated AI Reasoning Extraction Campaign Linked to Moonshot AI
OpenAI disrupted a coordinated distillation campaign attempting to illicitly extract protected reasoning from its AI models, attributing core activity to Moonsh
Guides
Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix
Threat actors are weaponizing ChatGPT Custom GPTs to redirect victims to ClickFix lures that deploy a full-featured remote access trojan via DLL sideloading.
Tools
ShinyHunters Bypass WAFs to Exploit Critical Oracle PeopleSoft Flaw
UNC6240 is mass-exploiting CVE-2026-35273 in Oracle PeopleSoft by URL-encoding requests to bypass WAF rules, deploying web shells and backdoors across multiple
VPN & Privacy
Anthropic's AI Misuse Report: Key Findings on Claude Abuse
Anthropic published a detailed report on Claude misuse cases. Key findings cover credential theft, influence operations, surveillance, and weapons research.
Threats
Malicious Terraform Providers and Go Modules Linked to DPRK Campaign
DPRK-linked attackers are distributing Go-based malware via Terraform providers and Go modules, marking a novel supply chain distribution vector.