Comparing 24 October 2026 with the previous day 23 October 2026.
The report shows that a UEFI bootkit is using an old Secure Boot vulnerability in an active espionage campaign while attempting to tamper with Kaspersky and Avast security software.
No changes in this category.
No changes in this category.
The alert contains only the CVE summary; no information on active exploitation, affected versions, or attacker TTPs.
The report shows a China-linked actor automated an MSP supply-chain campaign with an AI-enabled penetration-testing tool and compromised more than 2,200 tenants , a strategic supply-chain risk beyond patch management.
The report shows that Sandworm, together with UAC-0099, is using a new mesh-network backdoor for destructive wiper attacks on logistics targets, making the state-sponsored threat to European supply chains more concrete.
The report adds to patch information the insight that a Chinese state actor is using an AI-powered pentest tool to compromise hundreds of organizations via ConnectWise remote-access/MSP channels.
The report shows that Sandworm, together with UAC-0099, deployed a new mesh network backdoor in a destructive attack on a Ukrainian logistics company, demonstrating ongoing Russian cyber-warfare against supply chains.
The advisory adds to the bare patch information by describing the attack vector via the BSend length field, through which an active S7 partner can trigger buffer overflows in SCADA, HMI or gateway processes; active exploitation is not demonstrated.
The report shows that AI is increasingly being used in state-sponsored espionage against Linux infrastructure, although the specific technical attack vector remains unclear in the excerpt.
The report shows Russia taking action against its own hacking groups while North Korea and commercial spyware vendors like Candiru continue to operate globally.
The report shows that the Iranian APT group Prince of Persia is again operating command-and-control infrastructure via US shared hosting after a pause, indicating continued state-sponsored cyber activity and adjustments in operational security.
CISA confirms exploitation in the wild , these flaws are therefore no longer mere patch candidates but already active attack surfaces on edge and remote-access devices.
The report describes a VM escape vulnerability in the Linux network stack that, without a CVE or evidence of active exploitation, is primarily relevant to Linux-based virtualization hosts.
The campaign shows that exposed FortiGate and GlobalProtect edge devices are actively targeted and that compromised credentials are used worldwide for further attacks, going beyond patch information.
The report shows that AI themes are used as a lure for a modular infostealer that collects system, clipboard and browser data.
The advisory bundles several Fortinet vulnerabilities without CVE, version or exploitation details and therefore adds no independent insight for prioritisation beyond the vendor advisories.
The report aggregates several vulnerabilities in Chromium-based browsers without naming a concrete active exploitation or CVE details, so the patch status of the deployed browser versions is the decisive factor.
The report lists no CVE IDs, CVSS scores, or active exploitation details; prioritization requires the Google and Microsoft advisories.