CTI status
As of:
Last pipeline run:
Source reliability
Information credibility
NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.
Switzerland is set to get its first standalone cybersecurity law; affected companies should track the consultation draft due by June 2027, as it may introduce reporting and operator obligations.
The report provides technical details on a Secure Boot bypass in GRUB where an insufficiently validated MMIO base address in the serial command allows loading unsigned modules despite active lockdown restrictions.
The report identifies the China-based APT Warlock as the attacker and shows that SharePoint exploitation has been active since July 2025 and is expanding to critical infrastructure.
No evidence of active exploitation or exploit code; the vulnerability allows code execution inside the Chrome sandbox but requires visiting a crafted web page.
The report only describes the vulnerability and provides no indication of active exploitation or attacker TTPs.
The report describes a pure vulnerability without indications of active exploitation or strategic implications.
The report contains no indication of active exploitation, threat actors, or affected sectors and does not go beyond the CVE description.
The report contains no information beyond the patch details about active exploitation or attack tactics.
Classifying an intrusion by ransomware payload alone obscures the affiliate behind it: Storm-2570 shows identical post-compromise tradecraft across Qilin, DragonForce, Anubis and BERT, providing a stable basis for detection.
A China-linked ransomware group uses SharePoint vulnerabilities as an initial access vector, confirming that collaborative Microsoft platforms are a favoured entry point for state-supported attackers.
The aggregated advisory lists no CVE IDs and no indication of active exploitation, so prioritisation must rely solely on the regular Chrome patch cycle.
The BSI advisory summarizes multiple vulnerabilities in GNU libc without providing specific CVE IDs or exploitation details.
This report contains no details beyond the pure patch information.
The alert updates previous OpenSSL advisories and points to multiple new vulnerabilities without providing specific CVE details.
The report lacks CVE IDs and details on active exploitation, so no prioritized patching order can be derived.
The report provides no patch information but a quarterly telemetry assessment of ICS-related malware campaigns and newly documented APT tooling for industrial environments.