Delta Investigates Wi-Fi Deauth Attack on DEF CON Flight
Delta Air Lines is investigating an unauthorized Wi-Fi network and deauthentication attack on a Las Vegas-to-Atlanta flight carrying DEF CON attendees.
GuidesThreat Intelligence Feed
-
-
BdThemes Supply-Chain Hack Creates Rogue WordPress Admin Accounts
A threat actor compromised BdThemes' upstream infrastructure to inject malicious JavaScript that creates rogue WordPress admin accounts on affected sites.
VPN & Privacy -
N-able Releases Second N-Central Hotfix as Attacks Escalate
N-able issued a mandatory second hotfix for CVE-2026-18577 after threat actors evolved attack techniques to reach managed endpoints via Cloudflare Tunnels.
Guides -
OVSwrap Linux Kernel Flaw Enables Local Privilege Escalation to Root
CVE-2026-64531 (OVSwrap) lets unprivileged local users reach root via a memory corruption bug in the Linux kernel's Open vSwitch datapath.
Threats -
SMOKE#SCREEN Campaign Abuses ScreenConnect RMM via Fake Software Updates
A multi-wave campaign uses fake Adobe and Zoom update lures to deploy ConnectWise ScreenConnect. A separate campaign distributes the Powercat Java stealer via f
Guides -
Chinese Threat Actor Deploys Leaked DarkSword iOS Exploit Kit
A Chinese-speaking threat actor is running 100+ fake AWS and Apple ID pages to deliver the leaked DarkSword iOS exploit kit and GHOSTBLADE malware.
VPN & Privacy
Analysis & Guides
VPN & Privacy
Hugging Face Publishes Detailed Timeline of OpenAI Agent Intrusion
Hugging Face released a forensic timeline of the OpenAI agent intrusion, reconstructing ~17,600 attacker actions across a two-stage campaign targeting its infra
Guides
Rails Patches Critical CVE-2026-66066 Active Storage Flaw With RCE Potential
A critical flaw in Rails' Active Storage framework allows unauthenticated file reads and potential RCE. Patch immediately and rotate all secrets.
Tools
Russian Hackers Exploit Exchange OWA Zero-Day to Deploy OWAReaper Backdoor
Laundry Bear is exploiting a zero-day XSS flaw in Exchange OWA to deploy the OWAReaper backdoor, enabling persistent mailbox access that survives credential res
Threats
GitHub and PyPI Add Time-Based Defenses Against Supply Chain Attacks
GitHub has added a 72-hour Dependabot cooldown, while PyPI now blocks new files added to releases older than 14 days.
Threats
CTM360: Insurance Phishing Kits Now Hijack Accounts in Real Time
CTM360 research exposes a phishing kit targeting insurance portals with real-time OTP interception and live session hijacking across multiple regions.
Tools
Check Point Patches Actively Exploited Authentication Bypass CVE-2026-16232
Check Point has patched three vulnerabilities, including a critical actively exploited authentication bypass in SmartConsole. CISA has added the flaw to its KEV
Tools
Google Adds Selfie Video as Account Recovery Option
Google has introduced an opt-in selfie video feature for account recovery. It uses facial comparison to verify identity when users are locked out.
Threats
Flock License Plate Cameras: Misidentification, Tracking, and Abuse
A viral incident exposes how Flock's camera network wrongly tracked a writer using partial plate matching, while police use the system to surveil people, not ju
VPN & Privacy
GoldenEyeDog Subgroup CylindricalCanine Linked to April 2026 DigiCert Breach
Expel attributes the April 2026 DigiCert certificate theft to CylindricalCanine, a subgroup of Chinese cybercrime group GoldenEyeDog using Golden Gh0st RAT.