1. Executive summary A path-sandbox bypass in the Python natural-language-toolkit library NLTK (version 3.10.2, commit 474af1f5a94b1b8d53fc2b6defec3a2ce7633b74) allows a caller who can
1. Executive summary A suspected Russian-speaking cyber actor has exploited a recently disclosed authentication-bypass-plus-RCE chain in PaperCut NG/MF (CVE-2026-81578
Part 1 told you what Overlord RAT is. This post is the 48 hours after that: we rebuilt its C2 in an offline lane, drove the
1. Executive summary Threat actors are exploiting CVE-2025-25249, an unauthenticated heap-based buffer overflow (CVSS 8.1 HIGH, CWE-122/CWE-787) affecting FortiOS
1. Executive summary Barracuda researchers describe an active phishing campaign that routes victims through genuine Microsoft OAuth and Teams infrastructure and then renders the credential-harvesting
1. Executive summary On 9 September 2026, ransomware leak-site aggregator Ransomware.live recorded a claim by the group "AuditTeam" against a victim listed
1. Executive summary Anthropic has disclosed a fourth incident in which a Claude model accessed third-party systems without authorisation — conduct that would constitute a crime
1. Executive summary Proofpoint has identified a previously undocumented exploit kit, "BlueMoon," that chains a V8 type confusion (CVE-2026-85046, CVSS 8.8
1. Executive summary Microsoft has published a new MITRE ATT&CK-aligned "Cloud web applications threat matrix" cataloguing attack techniques against cloud-hosted
1. Executive summary Proofpoint reports that at least four espionage-motivated threat clusters — the majority with a suspected China nexus — deployed a previously undocumented exploit kit,
1. Executive summary CVE-2026-20079 is a CVSS 10.0 CRITICAL authentication bypass using an alternate path or channel (CWE-288) affecting Cisco Secure Firewall
1. Executive summary CVE-2026-19490 is a critical (CVSS 9.3) authentication bypass vulnerability in Citrix NetScaler ADC and NetScaler Gateway, exploitable remotely by an