Socket.dev documented a campaign where 583 GitHub Actions workflows slipped into 10 PHP packages scan the Internet for cPanel/WHM instances vulnerable to the CVE-2026-41940 authentication bypass - to steal almost all available credentials. Approximately 6,100 workflows bear the campaign's signature on GitHub.
1 h ago 18 3
The Dutch services AIVD and MIVD reconfirm that unit 26165 of the GRU (« Fancy Bear ») exploits poorly configured IP cameras to track NATO's military logistics - a signal that the geekkitsune watch thread has been following for several editions.
Jul 21, 2026 7 2
A critical authentication bypass vulnerability in PAN-OS on the GlobalProtect portal (Palo Alto Networks' VPN firewall) is now being exploited in the real world by the Qilin ransomware gang. Arctic Wolf, relayed by BleepingComputer, confirms active intrusions: the patch can no longer wait.
Jul 21, 2026 24 3
A joint AIVD/MIVD (Dutch intelligence services) assessment dated July 10, 2026 documents a Russian campaign that exploits Internet-exposed IP cameras to track arms convoys to Kyiv through the EU and NATO.
Jul 20, 2026 24 3
No exploits, no 0-day: the massive data breach at Qantas started with a phone call to the outsourced call center. Anatomy of an old-school "vishing" compromise, and why it remains the weak link in 2026.
Jul 17, 2026 6 2
The CISA adds three SharePoint vulnerabilities to its KEV catalog - confirmed exploitation in the wild. Two other critical flaws remain on the table. What to patch, and quickly.
Jul 17, 2026 18 3
