Brotli RCE Hits Node.js, .NET, Python - Patch Now
Brotli compression library RCE affects Node.js, .NET, PowerShell, and Python. Gheist steals GitHub secrets via Actions.
IT, Networking & Security
IT, Networking & Security — tutorials, guides, and insights.
Latest Posts
M365 Token Replay Hits 79 Orgs - MFA Bypassed
M365 AitM token replay campaign breached 97 accounts across 79 orgs. Gheist steals GitHub secrets via Actions logs. AI agent hijacked by AGENTS.md file.
Storm-0940 AI Agent OAuth Breach - 3 Hours
Storm-0940 used ARTEX AI agent to breach ConnectWise OAuth in under 3 hours. Railway PaaS secrets exposed. VeloCloud zero-day patched.
VeloCloud Third Zero-Day - SD-WAN Under Siege
VeloCloud Orchestrator hit by third zero-day in four months. Storm-0940 used AI to breach 2,200 MSPs in 3 hours. PHP discloses second unpatched RCE.
Storm-0940 AI Attack Hits Hundreds in 3 Hours
Storm-0940 used agentic AI for a 3-hour supply chain breach via ConnectWise. Plus GitLab CVSS 10.0 RCE and PHP2Shell exploited pre-patch.
Critical PHP RCEs Leaked Pre-Patch - CVE-2026-109618
CVE-2026-109618 and CVE-2026-109619 PHP RCE details leaked before patch. Plus Tor exit node hijacking and eMudhra CA key compromise forces cert reissuance.
eMudhra CA Keys Compromised - Forged Certs Now Possible
eMudhra CA private keys recoverable - forged certificates possible. ConnectWise resets all OAuth credentials after 173-tenant breach.
OVHcloud CLI Backdoored - 94 Minutes of Stolen Secrets
OVHcloud CLI hijacked via compromised GitHub account for 94 minutes. Qilin and Inc ransomware exploit PAN-OS CVE-2026-0257.
Broadcom Wi-Fi RCE Needs Zero Auth - Just Proximity
Unpatched Broadcom Wi-Fi chipset flaw gives root via radio range. ConnectWise Cloud Backup MSP supply chain compromise. SiteGuard WAF zero-day exploited.
ConnectWise OAuth Breach Hits 173 M365 Tenants
ConnectWise OAuth supply-chain breach accessed 173 M365 tenants. OpenCode AI key leak and npm credential stealers targeting AI developers covered.
BeyondTrust PAM Zero-Day - CVE-2026-102764
CVE-2026-102764 BeyondTrust PAM zero-day exploited by Chinese APT for six weeks. Ivanti auth bypass chain and CVSS 10 SAP OAuth credential leak also covere.
BeyondTrust PAM Zero-Day - CVE-2026-102764 CVSS 9.3
CVE-2026-102764 BeyondTrust PAM zero-day exploited by Chinese APT since August. CVE-2026-0322 PAN-OS management RCE patched.
Cisco Meraki Access Manager: Configuration Guide
A hands-on guide to Cisco Meraki Access Manager: cloud RADIUS and NAC for wired, wireless and VPN using 802.1X, MAB, iPSK and Microsoft Entra ID.
PAN-OS and Cisco Email Gateway Zero-Days Exploited
CVE-2026-0322 PAN-OS authenticated RCE and Cisco Secure Email Gateway unauthenticated RCE both exploited. PEERSTITCH implant hits 500+ FortiGate firewalls.
Ivanti VPN Auth Bypass Chain - CVE-2026-104935
CVE-2026-104935 Ivanti VPN auth bypass chain exploited in the wild. SAP OAuth2 CVSS 10 credential leak and Microsoft phishing platform takedown.
Record 1,413-Patch Tuesday - CVE-2026-96951 Exploited
CVE-2026-96951 Windows Shell zero-day exploited in the wild amid Microsoft's record 1,413-patch drop. Ivanti VPN root chain and DPRK laptop farm raids.
GitLab CVSS 10 RCE - No Auth CI/CD Regex Flaw
GitLab patches CVSS 10.0 unauthenticated RCE in CI/CD regex compiler. Plus Ahold Delhaize multi-country cyberattack and an $86M hardware supply chain heist.
Claude Agents Hit a Live Bank - AI Identity Risk
Claude AI agents confirmed in South Korean bank attacks. GitLab CVSS 10 RCE exposes CI/CD secrets. 340+ GitHub repos hijacked via stolen maintainer credent.
SonicWall SMA 1000 CVSS 10 Exploited - CVE-2026-102255
CVE-2026-102255 SonicWall SMA 1000 pre-auth SSRF exploited 135+ times. ShinyHunters arrest and AI-orchestrated Ukrainian breach campaign covered.
NetScaler SAML RCE - CVE-2026-107406 CVSS 9.0
CVE-2026-107406 NetScaler SAML RCE hits CVSS 9.0. FBI seizes Flax Typhoon tools. Cisco patches 12 critical NX-OS flaws.