What has changed?

CVE-2023-45858

Beyond the plain patch information, the alert provides no evidence of active exploitation; the flaw allows reading local files and is fixed in version 23.4.88.1429.

'Sandworm' Chains Cisco Vulnerabilities to Deploy Cyclops Blink

The GRU actor Sandworm is chaining Cisco vulnerabilities to spread an upgraded Cyclops Blink variant and maintain persistent control over compromised network devices.

APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit

The use of a signed kernel driver as a rootkit shows the group is deliberately bypassing EDR detection on Windows endpoints and servers, not merely exfiltrating data.

UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations

For the first time, an APT actor is documented systematically using agentic AI tooling (playbooks, exploit automation, payload generation) across the entire post-compromise lifecycle, significantly increasing the speed and scalability of intrusions.

CVE-2023-28148

The report provides no information beyond the patch details about active exploitation or new attack vectors.

CVE-2026-85921

The report provides no information beyond the plain CVE description; there is no indication of active exploitation, a PoC, or threat actors.

CVE-2026-85892

Beyond the pure patch information, the report provides no indications of active exploitation, threat actor groups, or affected victim sectors.

CVE-2023-22631

Beyond the plain patch information, the report adds no new insight: there is no indication of active exploitation, nor any details on TTPs or affected sectors.

UAT-10147 deploys SPECTRE: A cross-platform implant with Linux rootkit and BYOVD capabilities

The combination of a Linux kernel rootkit, BYOVD EDR neutralisation and cross-platform C2 in a single, widely deployed implant shows that kernel-level evasion techniques are no longer reserved for top-tier state actors.

ClickFix Campaigns Abuse Legitimate Services for Persistent Access

ClickFix campaigns use legitimate system services for persistent attacks and therefore require user awareness rather than pure patch management.

Microsoft Edge: Vulnerability allows Cross-Site Scripting

[UPDATE] 7-Zip: Vulnerability allows bypassing security restrictions

[UPDATE] Linux Kernel: Multiple Vulnerabilities

The report does not provide specific CVE IDs or attack details, so the actual exposure and urgency remain unclear.

[UPDATE] Google Chrome/Microsoft Edge: Multiple Vulnerabilities

UPDATE: Paessler PRTG: Vulnerability Allows Information Disclosure

The vulnerability in Paessler PRTG allows information disclosure, which can compromise the confidentiality of monitoring data.

[UPDATE] Paessler PRTG: Multiple Vulnerabilities

[UPDATE] OpenSSH: Multiple Vulnerabilities