BLOG
Notes from the field
Threat analysis, detection engineering and hands-on training notes from the practice.
-
Threat digest: 2026-10-16
Freshly confirmed exploitation of Atlassian Data Center and Ivanti Connect Secure flaws leads the day, alongside Microsoft's record patch release, a Linux kernel bug that breaks cloud sandbox…
-
Threat digest: 2026-10-15
Three exploited vulnerabilities added to CISA's catalog, including zero-days in Palo Alto firewalls and Cisco email gateways plus unpatched Ahsay backup flaws, headline a day that also brought…
-
Threat digest: 2026-10-14
Microsoft's largest ever Patch Tuesday (1,411 flaws and three zero-days, one already exploited) and an Ivanti Connect Secure zero-day chain against a fully patched VPN appliance top a…
-
Threat digest: 2026-10-13
Maximum-severity flaws in GitLab, the Bricksforge WordPress plugin and SonicWall SMA1000 appliances drove both urgent patching and exploitation activity, a confirmed hardware implant in Ledger wallets sold through…
-
Threat digest: 2026-10-12
AI-enabled attacks and supply chains led the day: ransomware crews exploited a Palo Alto GlobalProtect authentication bypass, a suspected North Korean crew backdoored a fake Terraform provider, lab…
-
Threat digest: 2026-10-11
China-linked actors led the day: CISA added five Flax Typhoon flaws to its exploited list with a federal patch deadline of October 11, Citrix's NetScaler zero-days drew a…
-
Threat digest: 2026-10-10
SonicWall's maximum-severity SMA1000 flaw is now being exploited in the wild, Ledger is investigating a reported 87 million dollar drain from wallets bought through a reseller, and a…
-
Threat digest: 2026-10-09
CISA added five already-patched but actively exploited CVEs to its KEV catalog with a three-day fix deadline, FortiBleed operators began locking admins out of compromised Fortinet devices, and…
-
Threat digest: 2026-10-08
The FBI warned that the FortiBleed campaign has compromised more than 86,000 Fortinet devices and is still locking out admins, Atlassian's CVE-2026-21589 is being exploited within hours of…