If this edition of the newsletter has a single recurring theme, it's that the systems and institutions we trust to keep us secure are themselves becoming the attack surface. The agency responsible for securing federal infrastructure leaked its own cloud keys. A major open-source ecosystem had its
This edition covers 21 of the most significant cybersecurity stories from May 11 to May 17 2026 — spanning zero-day disclosures, ransomware attacks on education and pharma, AI-powered exploits, supply chain compromises, and shifting regulatory landscapes. Each entry includes a three-sentence summary and clear, actionable takeaways. Shai-Hulud
This week’s threat intel underscores accelerating risk across perimeter infrastructure, software supply chains, and identity. Attackers—including suspected state-linked actors and organized cybercriminals—are exploiting high-value entry points such as firewall services, long-standing OS flaws, phishing-driven credential theft, and trusted developer tooling to gain access,
New versions of the XWorm backdoor are being distributed in phishing campaigns after the original developer, XCoder, abandoned the project in 2024. The latest variants—6.0, 6.4, and 6.5—are used by various threat actors and support plugins that enable a wide range of malicious activity. This
In this week’s newsletter we cover credential-stealing malware and extortion tradecraft, Windows security changes and escalation techniques, and a wave of software supply-chain risks such as GitHub Actions, PyPI, and malicious extensions. DEEP Python Backdoor Uses Public Tunneling for C2, Steals Browser + Cloud Credentials Researchers detailed a
This week’s threat intel highlights a wave of account-takeover and social-engineering intrusions, escalating ransomware and OT/ICS risks, and continued DDoS and perimeter-device exploitation—reinforcing the need to harden identity controls, rotate secrets, patch fast, and tightly segment and monitor critical infrastructure. Vercel Confirms Security Breach
Last week’s stories highlight a clear trend: attackers are succeeding by moving faster than organizations can patch and by targeting the areas that most often get overlooked—third‑party software and dependencies, exposed admin/management systems, and credentials/API keys. We’re seeing this play out in several ways:
This week’s newsletter centers on how attackers (and platforms) are increasingly using “quiet” collection and trust abuse to gain leverage—ranging from subtle tracking and data leakage (like extension fingerprinting and exposed API keys), to high-impact compromises and extortion, to social-engineering and supply-chain tactics that turn
This week’s newsletter focuses on urgent patching and active exploitation: critical Citrix NetScaler and Cisco FMC issues (including a ransomware-linked zero-day), plus Quest KACE and Oracle fixes. It also highlights disruption of a huge router proxy botnet, Russia-aligned phishing targeting Signal/WhatsApp accounts, and a major
Overview In this report I discuss SILENTCONNECT, a newly discovered multi-stage malware loader that has targeted Windows machines since early March 2025. It has been observed actively in the wild. Its primary objective is to silently download and install ConnectWise ScreenConnect on the victim’s system, giving threat actors
This week’s threat landscape highlights a sharp mix of ransomware and extortion pressure, credential-driven breaches, and active exploitation of high-impact enterprise and management-plane vulnerabilities. Healthcare and service providers remain prime targets, while phishing and social engineering continue to enable account takeovers and sensitive data exposure. At
This week's threat intel highlights multiple campaigns abusing trusted infrastructure and user habits to steal data and gain access. These include fake GitHub download pages and cloned install docs that trick people into running malicious commands. We cover major disruption events—the FBI system investigation and Stryker'