The Register and The Hacker News reported on September 2, 2026, that SonicWall SMA1000 appliances are once again under active attack, with two zero-days capable of forming a full exploit chain. Immediate operational priority.
Sep 3, 2026 2 1
Researchers used Claude to port a pre-auth RCE exploit from one industrial automation (PLC) model to another. The exploit porting barrier, which effectively protected less common equipment, has now fallen.
Sep 3, 2026 12 3
The wp2shell vulnerability in WordPress Core allows unauthenticated remote code execution. Public exploits are circulating. If your installation isn't up to date, you're at risk—and 43% of the web runs on WordPress.
Sep 2, 2026 9 2
The CISA has just added six new entries to its KEV (Known Exploited Vulnerabilities) catalog. These include vulnerabilities in NetScaler (Citrix), the Linux kernel, and Microsoft SQL Server—all actively exploited in real-world conditions.
Aug 28, 2026 2 1
Attackers are actively exploiting vulnerabilities in on-premises SharePoint Server to gain Farm Administrator rights and steal IIS machine keys to maintain access even after applying a patch.
Aug 25, 2026 4 1
A critical RCE flaw in VMware vCenter Syslog Server is being exploited in an active campaign. Attackers are deploying reverse SSH to maintain persistent access to hypervisors. The string of virtualization vulnerabilities continues.
Aug 14, 2026 9 3
A new malicious campaign dubbed DOUBLECUP exploits the ClickFix technique and cached PNGs to distribute two malware families: CountLoader and DeviceManager RAT. Anatomy of a two-stage attack.
Aug 4, 2026 24 3
The Dutch services AIVD and MIVD reconfirm that unit 26165 of the GRU (« Fancy Bear ») exploits poorly configured IP cameras to track NATO's military logistics - a signal that the geekkitsune watch thread has been following for several editions.
Jul 21, 2026 7 2
A critical authentication bypass vulnerability in PAN-OS on the GlobalProtect portal (Palo Alto Networks' VPN firewall) is now being exploited in the real world by the Qilin ransomware gang. Arctic Wolf, relayed by BleepingComputer, confirms active intrusions: the patch can no longer wait.
Jul 21, 2026 24 3
A joint AIVD/MIVD (Dutch intelligence services) assessment dated July 10, 2026 documents a Russian campaign that exploits Internet-exposed IP cameras to track arms convoys to Kyiv through the EU and NATO.
Jul 20, 2026 24 3
No exploits, no 0-day: the massive data breach at Qantas started with a phone call to the outsourced call center. Anatomy of an old-school "vishing" compromise, and why it remains the weak link in 2026.
Jul 17, 2026 6 2
