N-able Releases Second N-Central Hotfix as Attacks Escalate
N-able issued a mandatory second hotfix for CVE-2026-18577 after threat actors evolved attack techniques to reach managed endpoints via Cloudflare Tunnels.
GuidesThreat Intelligence Feed
-
-
OVSwrap Linux Kernel Flaw Enables Local Privilege Escalation to Root
CVE-2026-64531 (OVSwrap) lets unprivileged local users reach root via a memory corruption bug in the Linux kernel's Open vSwitch datapath.
Threats -
SMOKE#SCREEN Campaign Abuses ScreenConnect RMM via Fake Software Updates
A multi-wave campaign uses fake Adobe and Zoom update lures to deploy ConnectWise ScreenConnect. A separate campaign distributes the Powercat Java stealer via f
Guides -
Chinese Threat Actor Deploys Leaked DarkSword iOS Exploit Kit
A Chinese-speaking threat actor is running 100+ fake AWS and Apple ID pages to deliver the leaked DarkSword iOS exploit kit and GHOSTBLADE malware.
VPN & Privacy -
Hugging Face Publishes Detailed Timeline of OpenAI Agent Intrusion
Hugging Face released a forensic timeline of the OpenAI agent intrusion, reconstructing ~17,600 attacker actions across a two-stage campaign targeting its infra
VPN & Privacy -
Rails Patches Critical CVE-2026-66066 Active Storage Flaw With RCE Potential
A critical flaw in Rails' Active Storage framework allows unauthenticated file reads and potential RCE. Patch immediately and rotate all secrets.
Guides
Analysis & Guides
Tools
Russian Hackers Exploit Exchange OWA Zero-Day to Deploy OWAReaper Backdoor
Laundry Bear is exploiting a zero-day XSS flaw in Exchange OWA to deploy the OWAReaper backdoor, enabling persistent mailbox access that survives credential res
Threats
GitHub and PyPI Add Time-Based Defenses Against Supply Chain Attacks
GitHub has added a 72-hour Dependabot cooldown, while PyPI now blocks new files added to releases older than 14 days.
Threats
CTM360: Insurance Phishing Kits Now Hijack Accounts in Real Time
CTM360 research exposes a phishing kit targeting insurance portals with real-time OTP interception and live session hijacking across multiple regions.
Tools
Check Point Patches Actively Exploited Authentication Bypass CVE-2026-16232
Check Point has patched three vulnerabilities, including a critical actively exploited authentication bypass in SmartConsole. CISA has added the flaw to its KEV
Tools
Google Adds Selfie Video as Account Recovery Option
Google has introduced an opt-in selfie video feature for account recovery. It uses facial comparison to verify identity when users are locked out.
Threats
Flock License Plate Cameras: Misidentification, Tracking, and Abuse
A viral incident exposes how Flock's camera network wrongly tracked a writer using partial plate matching, while police use the system to surveil people, not ju
VPN & Privacy
GoldenEyeDog Subgroup CylindricalCanine Linked to April 2026 DigiCert Breach
Expel attributes the April 2026 DigiCert certificate theft to CylindricalCanine, a subgroup of Chinese cybercrime group GoldenEyeDog using Golden Gh0st RAT.
VPN & Privacy
Forgotten UEFI Shims Undermine Secure Boot on Most UEFI Systems
ESET found 11 old UEFI shims that bypass Secure Boot on most UEFI systems. Microsoft revoked the vulnerable binaries in the June 2026 Patch Tuesday update.
Guides
Microsoft Patches Record 570 Security Flaws in July Patch Tuesday
Microsoft fixed 570 vulnerabilities in July's Patch Tuesday, nearly triple last month's record. AI-assisted discovery is driving the surge in patch volume.