What has changed?

Armored Likho expands its cyber-espionage toolkit

The campaign uses fundraising and Starlink lures as bait and delivers a new toolkit generation that steals Telegram data and eavesdrops on victims.

ZDI-26-571: Linux Kernel Net Scheduler Packet Classifier API Use-After-Free Local Privilege Escalation Vulnerability

The flaw allows local attackers to escalate privileges in the Linux kernel and affects unpatched Ubuntu systems.

BlueMoon Exploit Kit Chains Recent Chrome, Windows Zero-Days

Bundling several already-patched zero-days into a circulating exploit kit lets even less skilled espionage-motivated actors exploit them, making the window between patch availability and patch deployment the decisive risk factor.

Threat landscape for industrial automation systems. Q2 2026

The report provides a quarterly overview of the threat landscape for industrial automation systems and documents new APT malware attributed to Mirage Kitten, which is strategically relevant for production environments.

Google Chrome: Multiple Vulnerabilities

The report summarizes multiple vulnerabilities in Google Chrome without specific CVEs or exploit details; timely patch management remains necessary.

7-Zip: Vulnerability allows code execution

The vulnerability requires user interaction and affects widely used compression software installed in many corporate environments; a CVE ID is not yet available.

Microsoft Edge: Multiple Vulnerabilities

This BSI advisory lists multiple Edge vulnerabilities without CVE references and without indication of active exploitation.

Benchmaxxing: When the Benchmark Becomes the Target

The report describes a novel attack technique (Benchmaxxing) that goes beyond pure patch information and provides new TTPs for defense.

[UPDATE] Linux Kernel: Multiple Vulnerabilities Allow Denial of Service

The advisory summarises multiple Linux kernel vulnerabilities without providing specific CVEs or evidence of active exploitation.

Microsoft Edge: Multiple vulnerabilities enable information disclosure and spoofing attacks