One seed email, forty passive queries, 1,081 candidates, four live surveys, and a shortlink that resolved to a Klarna kit on a compromised WordPress host. Including the false positive the tool produced.
1. Executive summary The ransomware group calling itself emperador listed Frommann Energie GmbH, a German seller and distributor of heating oil, motor fuels and lubricants, on
1. Executive summary The ransomware group calling itself emperador listed Phoenix S&S GmbH, a Frankfurt am Main company providing building maintenance, construction services, logistics
1. Executive summary The qilin ransomware group listed SLTN Inter Access, a Netherlands-based company (sltn.nl), on its leak site on 2026-10-24. The
1. Executive summary An out-of-bounds write in Google's Brotli decoder (CVE-2026-111497) has been rated CVSS 9.2, critical, and affects
1. Executive summary Symantec's Threat Hunter Team captured the full instruction set of an offensive AI agent that hunts for internet-exposed, unauthenticated OpenAI-
1. Executive summary The qilin ransomware group listed von Schaewen, a German victim, on its leak site on 2026-10-23. The only public detail is
1. Executive summary On 19 October 2026, between 12:47 and 14:21 UTC, an attacker using the GitHub account HassenBF replaced the release binaries on
1. Executive summary The N0n ransomware group listed a Spanish smart grid engineering firm, indexed as Company #110, on its leak site on 2026-10-23.
1. Executive summary The aurora ransomware group listed ARX Group SA, a Swiss engineering consultancy with more than 25 offices in 17 countries, on its leak
1. Executive summary Arista has patched an actively exploited SQL injection in on-premises VeloCloud Orchestrator (VCO), tracked as CVE-2026-114625 and rated CVSS 9.
1. Executive summary Two critical PHP engine flaws, CVE-2026-109618 and CVE-2026-109619, both scored CVSS 9.2 and both unauthenticated remote code execution,