Comparing 21 September 2026 with the previous day 14 September 2026.
The report provides a public exploit for an incomplete Windows patch and describes a novel technique for abusing dangling COM object registrations.
The report shows that North Korean APT groups deliberately abuse IT service providers as a stepping stone into their customers' networks, meaning the real risk lies less with the compromised provider than with its clients.
The campaign shows that North Korean actors use fake recruitment and coding-test processes to target IT and engineering professionals and trick them into executing malicious code , a social-engineering vector that can also reach non-crypto engineering teams in DACH organizations.
The flaws allow not only reading but also writing to the NAS, enabling manipulation or persistence on storage systems , patches are available.
The 'PAYLOAD' ransomware uses tampered Group Policy Objects as a distribution mechanism, so a single compromised AD account can trigger infection across an entire domain network.
The BSI WID does not provide CVE IDs or severity ratings; the report is an aggregated patch update for Chrome and Edge.
Microsoft announces the end of SMS first-factor authentication in Entra ID starting February 2027, requiring early migration to passkeys to avoid sign-in disruptions.
The report contains no CVE ID, no CVSS score, and no exploitation status, which complicates prioritization for patch processes.
No changes in this category.
No changes in this category.
Beyond the plain patch information, the alert provides no evidence of active exploitation; the flaw allows reading local files and is fixed in version 23.4.88.1429.
The GRU actor Sandworm is chaining Cisco vulnerabilities to spread an upgraded Cyclops Blink variant and maintain persistent control over compromised network devices.
The use of a signed kernel driver as a rootkit shows the group is deliberately bypassing EDR detection on Windows endpoints and servers, not merely exfiltrating data.
For the first time, an APT actor is documented systematically using agentic AI tooling (playbooks, exploit automation, payload generation) across the entire post-compromise lifecycle, significantly increasing the speed and scalability of intrusions.
The report provides no information beyond the patch details about active exploitation or new attack vectors.
The report provides no information beyond the plain CVE description; there is no indication of active exploitation, a PoC, or threat actors.
Beyond the pure patch information, the report provides no indications of active exploitation, threat actor groups, or affected victim sectors.
Beyond the plain patch information, the report adds no new insight: there is no indication of active exploitation, nor any details on TTPs or affected sectors.
The combination of a Linux kernel rootkit, BYOVD EDR neutralisation and cross-platform C2 in a single, widely deployed implant shows that kernel-level evasion techniques are no longer reserved for top-tier state actors.
ClickFix campaigns use legitimate system services for persistent attacks and therefore require user awareness rather than pure patch management.
The report does not provide specific CVE IDs or attack details, so the actual exposure and urgency remain unclear.
The vulnerability in Paessler PRTG allows information disclosure, which can compromise the confidentiality of monitoring data.