Ransomware: threeam named bhn-expertise.com (DE)
1. Executive summary A ransomware operator using the name "threeam" listed bhn-expertise.com on its leak site on 2026-09-28. The victim
28 Sep 2026 · 6 min read
read →
// author
Jeff Davies
Ransomware: threeam named safescaffolding.net (GB)
1. Executive summary A ransomware listing on 2026-09-28 named safescaffolding.net, a UK scaffolding contractor, as a victim of the group "threeam"
28 Sep 2026 · 5 min read
read →
Apple Emergency Patch for iOS 26/macOS26/macOS15 (CVE-2026-86950)
1. Executive summary Apple has released out-of-band security updates for iOS 26, macOS 26 (Tahoe) and macOS 15 (Sequoia) addressing CVE-2026-86950, an
28 Sep 2026 · 7 min read
read →
Other users can watch your browsing and time your keystrokes through OS file notifications
1. Executive summary Researchers at Graz University of Technology have shown that the file-notification subsystems shipped by Linux, Windows, macOS and Android leak activity from
28 Sep 2026 · 11 min read
read →
Google Warns of ShinyHunters Fresh Oracle PeopleSoft Campaign
1. Executive summary ShinyHunters (MITRE G1057, tracked by Google as UNC6240) has launched a second mass-exploitation campaign against Oracle PeopleSoft, modifying its exploit for CVE-
28 Sep 2026 · 10 min read
read →
Ransomware: N0n named Dediserve Ltd (GB)
1. Executive summary The extortion group tracked as N0n listed Dediserve Ltd, a GB-registered cloud infrastructure provider within the iomart group, on its leak site
28 Sep 2026 · 8 min read
read →
Zero-Day Exploitation of Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772
1. Executive summary Citrix disclosed eight vulnerabilities in NetScaler ADC and NetScaler Gateway on 2026-09-27, two of which are critical remote code execution flaws
28 Sep 2026 · 8 min read
read →
Exploitation of vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway
1. Executive summary Citrix has published a security bulletin covering eight vulnerabilities in NetScaler ADC and NetScaler Gateway, two of which (CVE-2026-88771 and CVE-
28 Sep 2026 · 6 min read
read →
JADEPUFFER-Linked Attackers Used Compromised Service Principals to Delete Azure Resources
1. Executive summary Between early June 2026, two compromised service principals in a single Azure tenant carried out an 18-hour intrusion that ended in bulk
28 Sep 2026 · 9 min read
read →
Forty Bytes to the Panel: Feeding a Fresh SNOWLIGHT Windows Stager From an Emulated C2
A 3.5 KB Windows loader with one import, a split-up C2 address, and a forty-byte handshake it repeats until somebody answers. We answered
28 Sep 2026 · 7 min read
read →
Ransomware: emperador named Car Service Abschlepp (DE)
1. Executive summary On 27 September 2026 the ransomware operator "emperador" listed the German vehicle recovery and towing firm CSA Car Service Abschlepp- &
28 Sep 2026 · 4 min read
read →
UK: Ten NHS staff removed over Noah Woods data breach
1. Executive summary Ten staff at East Suffolk and North Essex NHS Foundation Trust have been removed from duty or suspended after unauthorised access to the
28 Sep 2026 · 4 min read
read →