CTI status
As of:
Last pipeline run:
Source reliability
Information credibility
NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.
The shift to compromised legitimate websites as phishing infrastructure and to password-protected container attachments (ZIP/RAR/VHDX) combined with the new RedFlick delivery technique significantly undermines signature- and URL-based detection.
A previously unknown China-based malware framework grants long-term, stealthy access to compromised networks , a sign of espionage rather than extortion.
The US has issued a bounty for an alleged Chinese Hafnium hacker, underscoring the ongoing threat from state-directed Chinese cyber operations.
A public working exploit shows that CVE-2026-66804 is only an incomplete fix of the 'Dark Elevator' COM registration bug (CVE-2026-50343), so dangling CLSID entries under HKEY_CLASSES_ROOT must be re-verified for completeness.
US authorities confirm an ongoing, global campaign to harvest Fortinet credentials and explicitly warn operators of two product types , this goes beyond a pure patch notice, since no CVE is the underlying vector.
The report describes an injection vulnerability in OpenSSH via special characters in the username, with no evidence of active exploitation.
Beyond the pure patch information, the report describes that a Backup Viewer account can be abused to execute code with SYSTEM privileges on the backup server, without evidence of active exploitation.
The campaign exploits reused or leaked credentials and legacy SHA-256 password storage on FortiGate devices, meaning even patched systems remain compromiseable through weak or reused credentials.
The FBI confirms that FortiBleed is not a closed patching case but an ongoing campaign in which attackers harvest credentials from exposed FortiGate VPNs and lock out legitimate administrators.
The report shows that ransomware groups increasingly abuse Active Directory Group Policy for enterprise-wide payload distribution, bypassing conventional endpoint protections.
Beyond the plain patch information, the alert shows that exploitation requires an active action by a portal user opening a crafted link, so the attack vector lies in the browser context of the Enterprise Manager web interface rather than in the backup data path itself.
An attacker holding only the low-privileged Backup Viewer role can modify the Enterprise Manager master key and stored antivirus update credentials, thereby compromising the trust basis of the entire backup and recovery chain.
The flaw breaks Veeam Cloud Connect's tenant boundary: an authenticated tenant can reach arbitrary files on the service provider host, undermining the trust architecture between customer and service provider.
The advisory lacks CVE IDs and technical details, so prioritization is only possible via the general OpenSSH patch status.
The BSI report contains no CVE IDs, which makes targeted prioritization and patch mapping for affected Linux systems difficult.
The report updates an existing warning but provides no details on affected versions or exploitation.
The report bundles multiple OpenSSH vulnerabilities that allow denial of service, information disclosure, file manipulation, and bypassing of security measures.