Security Feed

1. Executive summary A social engineering campaign tracked since May 2026 has attackers calling and texting employees directly on their personal (BYOD) phones while

1. Executive summary FinCEN has issued an alert to the U.S. financial industry alongside a study of more than 33,000 cyber fraud

1. Executive summary Traefik v3.2.0 through v3.7.12 fails to apply its entrypoint header-name sanitization — aliasHeadersStrategy / underscoreHeadersStrategy in delete or

1. Executive summary Microsoft Threat Intelligence reports a sustained wave of campaigns impersonating major AI brands — ChatGPT, Microsoft Copilot, DeepSeek and Claude — as lures

1. Executive summary Anthropic reports disrupting a cyberespionage operation (activity window December 2025–August 2026) whose tradecraft and targeting match the Russian state-nexus

1. Executive summary Cisco Talos is disclosing a WebDAV-based infection chain — investigated after an incident at a Ukrainian government organisation — that delivers the

1. Executive summary CISA has republished AVEVA security bulletin AVEVA-2026-006 covering four vulnerabilities in AVEVA Pipeline Integrity Monitor (PIMBoards) affecting versions up

1. Executive summary Cisco Talos has disclosed three distinct post-compromise activity clusters — two state-sponsored-linked and one crimeware/ransomware — actively exploiting two

1. Executive summary On 10 September 2026, the ransomware operator tracked as "lockbit5" listed the German-registered domain alphaomega-eng.com on

1. Executive summary Proofpoint has documented a previously unobserved exploit kit, "BlueMoon," that chains two Chrome V8 JavaScript engine flaws with a

1. Executive summary A China-linked actor tracked as UNC3569 exploited an unpatched design flaw in the Windows version of Sogou Input Method — the

1. Executive summary On 11 September 2026, Check Point released patches for two critical (CVSS 9.8) vulnerabilities — CVE-2026-85102 (CWE-295, improper