CVE-2024-27834 Apple PAC Bypass Exploited by APT29
APT29 is actively chaining Apple PAC bypass CVE-2024-27834 with WebKit RCE CVE-2025-43529 to harvest browser cookies, triggering CISA KEV binding remediation deadlines.
Cybersecurity
Vulnerabilities, threat intelligence, malware, breaches and defensive engineering.
Zyxel Fixes Zero-Day Exploited Network Switch Vulnerabilities
Zyxel has released urgent patches to address zero-day vulnerabilities actively exploited in the wild to compromise nearly 1,000 network switches.
APT29 Watering Hole Campaign Targets Mobile Platforms with DarkSword
Researchers reveal a sophisticated watering hole campaign by suspected Russian threat actors using reverse proxies, JavaScript profiling, and mobile exploit chains.
WordPress CVE-2026-119977 Exploited via Upgrade TOCTOU Flaw
CISA has added WordPress Core flaw CVE-2026-119977 to its Known Exploited Vulnerabilities catalog. Attackers are actively exploiting a TOCTOU race condition in core update staging paths for unauthenticated RCE.
Zero Wire Feed: Standardising Critical Vulnerability Triage
Cloudflare has launched Zero Wire, a public vulnerability intelligence feed on Cloudflare Radar designed to help security teams triage high-impact Internet-facing flaws and prioritize remediation.
XCPE Botnet Takedown Highlights Android OEM Supply Chain Flaws
Google Threat Intelligence disrupted the XCPE botnet operating on over 1.3 million Android TV set-top boxes. The operation uncovered pre-installed OEM backdoors that bypassed certification via post-boot payloads.
UEFI Bootkit BlackX Bypasses Secure Boot via Baton Drop
New research reveals that the BlackX UEFI bootkit successfully targets fully patched Windows systems, exposing the operational dangers of multi-stage patch management.
Dissecting the XCPE Botnet: Android OEM Firmware Backdoors
Technical breakdown of the XCPE botnet, revealing how an Android OEM preloaded system-level backdoors to compromise over 1.3 million set-top boxes.
CVE-2026-81648: Unpatched CVSS 10 Flaw in WordPress Plugin
Threat actors are actively targeting an unpatched maximum-severity vulnerability in the CryptoPayment Gateway WordPress plugin, allowing unauthenticated file deletion and cleartext credential theft.
CVE-2026-98432: Patching Linux IPv4 TCP Kernel RCE
CVE-2026-98432 is a critical CVSS 9.8 vulnerability in Linux kernel IPv4 TCP processing. Here is a technical breakdown of the flaw, MPTCP vector nuances, and Ubuntu patch deployment strategies.
Analysing Vulnerability Exploitation Trends and Real-World Blast Radius
A data-driven analysis of over 383,000 disclosed vulnerabilities reveals why threat actors target specific takeover classes and how practitioners can re-engineer remediation strategies.
CVE-2026-58115: Node-RED OT Flaw Exploited in Linux Malware Attacks
A maximum-severity unauthenticated remote code execution vulnerability in Node-RED, designated CVE-2026-58115, is being actively exploited in the wild to drop Linux malware on industrial control and IoT systems.