Security Feed

1. Executive summary Proofpoint has identified a previously undocumented exploit kit, "BlueMoon," that chains a V8 type confusion (CVE-2026-85046, CVSS

1. Executive summary Microsoft has published a new MITRE ATT&CK-aligned "Cloud web applications threat matrix" cataloguing attack techniques against

1. Executive summary Proofpoint reports that at least four espionage-motivated threat clusters — the majority with a suspected China nexus — deployed a previously undocumented

1. Executive summary CVE-2026-20079 is a CVSS 10.0 CRITICAL authentication bypass using an alternate path or channel (CWE-288) affecting Cisco

1. Executive summary CVE-2026-19490 is a critical (CVSS 9.3) authentication bypass vulnerability in Citrix NetScaler ADC and NetScaler Gateway, exploitable remotely

1. Executive summary CVE-2026-87491 is an out-of-bounds write vulnerability (CWE-787) in Google Chromium V8, rated CVSS 8.8 HIGH,

1. Executive summary CVE-2025-25249 is a heap-based buffer overflow (CWE-122 / CWE-787) affecting Fortinet FortiOS, FortiSwitchManager and FortiSASE, rated CVSS

1. Executive summary Microsoft Security Research is tracking active, multi-account cloud intrusions — observed since May 2026 — that begin with helpdesk-impersonation vishing and

1. Executive summary Akeyless has announced general availability of Akeyless Agentic Runtime Authority, a real-time identity control layer that enforces intent-based access

1. Executive summary Recorded Future Insikt Group identified 73 high-impact vulnerabilities actively exploited or operationally weaponised in August 2026, 43 of them rated

1. Executive summary A Chinese-language criminal group is compromising Brazilian government and education web servers and using them to host gambling-themed phishing

1. Executive summary Microsoft's September 2026 Patch Tuesday is the largest single-day release on record: 964 customer-actionable CVEs (104 Critical,