CTI status
As of:
Last pipeline run:
Source reliability
Information credibility
NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.
The October Patch Tuesday includes CVE-2026-96951, an already actively exploited Windows security bypass, but the report provides no details on attacks, TTPs, or affected sectors.
The report documents that a China-linked actor (Flax Typhoon) is actively exploiting vulnerabilities that CISA classifies as exploited in the wild , this is more than a patch note and points to ongoing state-sponsored attacks against exposed infrastructure.
The report describes only the vulnerability itself; there are no indications of active exploitation, public exploit code, or attribution to a threat actor.
The joint warning confirms ongoing state-sponsored Chinese cyber espionage targeting sensitive data worldwide, underlining the strategic threat to European industrial companies.
Star Blizzard has refined its detection evasion through large-scale phishing campaigns and the novel RedFlick technique, marking a significant shift in the Russian state actor's operational tradecraft.
The BSI confirms an active compromise campaign against German institutions, indicating a targeted threat for the DACH region.
The report highlights that North Korea continues to systematically infiltrate Western companies with IT workers under false identities to evade sanctions and generate foreign currency for its weapons program,a risk that also affects DACH companies when hiring remote IT staff.
The combination of BPFDoor and AVERAT shows that state-sponsored attackers use SMTP as a covert C2 channel to compromise Linux-based edge devices.
The flaw resides in Acrobat Reader DC's annotation handling and requires user interaction (opening a malicious file or visiting a malicious page), which makes it particularly attractive for targeted phishing.
Beyond the patch information, the advisory provides no indication of active exploitation or a public exploit.
Beyond the bare patch information: exploitation requires user interaction, and there are so far no indications of active exploitation in the wild.
There is no evidence of active exploitation or KEV inclusion; exploitation requires user interaction.
ZDI describes a use-after-free flaw in Acrobat Reader DC's annotation processing; there is no evidence of active exploitation.
The advisory describes another flaw in Photoshop's image parser; beyond patch information it contains no indication of active exploitation, a public exploit, or a new attack technique.
The vulnerability allows remote code execution with user interaction; an exploit is not publicly known at this time.
The report describes CVE-2026-66804 as an incomplete fix for a Windows LPE vulnerability, with a public exploit leveraging a dangling COM registration.
The vulnerability requires user interaction (opening a crafted file or web page) and is therefore primarily exploitable via email attachments and drive-by scenarios.
Beyond the plain patch information, the advisory contains no indication of active exploitation; what matters is that the flaw in the PDF parser allows code execution outside the sandbox, turning a browser bug into a full system-compromise vector.
The report merely describes a critical vulnerability without indications of active exploitation, exploit code, or a threat actor.
The report describes a pure information-disclosure vulnerability in 7-Zip that requires opening a crafted SquashFS archive; there are no indications of active exploitation or a strategic dimension.
Exploitation requires pre-existing low-privileged access and therefore acts as an escalation step after an initial compromise rather than as an entry point.
The vulnerability requires user interaction and has a low CVSS score of 3.3; it only allows information disclosure, which limits the risk.
The low CVSS score of 3.3 and the required user interaction limit the risk; no active exploit is known.
The vulnerability is only exploitable with user interaction and has a low severity score of CVSS 3.3, which lowers the priority for immediate action.
The vulnerability has a low CVSS score (3.3), requires user interaction, and there is no indication of active exploitation.
The campaign shows how customized phishing kits are operated at industrial scale and how coordinated disruption by vendors and partners can strike criminal infrastructure.
No insights beyond the patch information; no active exploitation or attack campaign is known.
The report provides no details beyond patch information, in particular no indication of active exploitation or a threat actor.
The report contains no information beyond the patch advisory regarding active exploitation or attack tactics.
Beyond the pure patch information, the report contains no indications of active exploitation, attack campaigns, or specific attacker TTPs.
Pure patch notification with no indication of active exploitation or attacker TTPs; the flaw allows code execution but is described as remaining confined within the Chrome sandbox.
The report provides no information beyond the pure CVE description, in particular no indications of active exploitation or attack campaigns.
The alert contains no information beyond the pure CVE description, in particular no evidence of active exploitation or a strategic campaign.
This report contains no information beyond the patch details, particularly no indication of active exploitation or attack campaigns.
The report contains no details beyond the patch information, in particular no indications of active exploitation or attackers.
The vulnerability requires prior local access, which limits exploitability compared to remotely exploitable flaws.
The vulnerabilities in Ubiquiti UnifiOS allow code execution and privilege escalation, thus directly affecting the network infrastructure.
The BSI report does not contain CVE IDs or CVSS scores, making prioritization of the vulnerabilities difficult.
The rating narrowly misses the critical threshold, underscoring the urgency despite the absence of an active exploitation report.
Attackers are already actively exploiting a Windows Shell vulnerability, increasing the urgency of patching.
The consolidated advisory bundles multiple vulnerabilities across several SIMATIC S7 product lines, indicating a broad attack surface in the PLC environment, with no active exploitation reported so far.
The BSI alert summarises multiple vulnerabilities in Windows and Windows Server without naming CVE IDs, exploitation status, or specific threat actors.
The report summarizes multiple vulnerabilities in Microsoft SQL Server without specifying CVEs, making prioritization difficult.
The BSI report provides no CVE IDs and no affected product versions, leaving unclear which UniFi components must actually be updated; the critical factor is the attack surface of the central network management interface, which is anonymously reachable from the network.
Microsoft's October Patch Tuesday fixes 1,413 vulnerabilities, including an actively exploited Windows Shell zero-day, underscoring the urgency of patch management.
The Wazza phishkit screens visitors through a multi-stage routing chain and only then delivers an Adobe-themed device-code phishing page, bypassing MFA protection and making URL-based detection significantly harder.
The report shows how PAYLOAD ransomware uses Group Policy Objects for distribution, posing a direct threat to Active Directory environments.
This is not merely a patch notice: the FortiMail zero-day is already being actively exploited and allows full compromise without authentication; no patch exists yet, and Fortinet only provides workarounds and IOCs.
The ZDI-26-607 vulnerability in Microsoft Office has no CVE entry, complicating tracking and prioritization for defenders.
The vulnerability requires existing local access in the LOCAL SERVICE context and was published without a CVE ID, which complicates prioritization.
The report provides no information beyond the patch details about active exploitation, exploit code, or targeted victims.
The report provides no indication of active exploitation or attacker TTPs, only the availability of patches for Veeam Backup & Replication.
An AI-powered turnkey package (phishkit, admin console, and victim tracking) drastically lowers the barrier to account takeover, letting even low-skill actors run session-hijacking attacks against cloud accounts.
BSI updates its advisory on multiple OpenSSH vulnerabilities without naming specific CVEs or indications of active exploitation.
The alert is a generic patch notice without new concrete vulnerabilities or exploit details.
The BSI advisory summarises several vulnerabilities in Adobe Acrobat and Reader but provides neither CVE IDs nor exploitation status; the concrete patch and version details must be taken from Adobe's own vendor bulletin.
The attack requires either two tap gestures on a controlled website or opening a malicious Office file.
The alert provides neither CVE IDs nor affected versions, so targeted prioritisation or patch verification is not possible.
The BSI report summarises several vulnerabilities in Adobe Bridge and Substance 3D without listing CVE IDs, CVSS scores or evidence of active exploitation, making it primarily a patch reminder rather than a warning about an ongoing campaign.
The vulnerability only allows a local denial of service; there is no evidence of remote exploitation or active attacks.
The quarterly report frames ICS threat statistics for Q2 2026 and links them to nation-state APT malware such as the activity of Mirage Kitten (UNC1549).