BLOG
Notes from the field
Threat analysis, detection engineering and hands-on training notes from the practice.
-
Threat digest: 2026-10-08
The FBI warned that the FortiBleed campaign has compromised more than 86,000 Fortinet devices and is still locking out admins, Atlassian's CVE-2026-21589 is being exploited within hours of…
-
Threat digest: 2026-10-07
Two WordPress flaws are being actively exploited to plant hidden administrator backdoors, alongside a critical Atlassian file-read flaw, a broad AI ad-portal phishing platform, and a run of…
-
Threat digest: 2026-10-06
A third Citrix NetScaler zero-day in a week and a mass Danish population-register breach lead the day, alongside a new AI-named IoT botnet, an out-of-band Exchange fix, and…
-
Threat digest: 2026-10-05
Citrix rushed out an emergency NetScaler patch for a SAML denial-of-service zero-day now in CISA's exploited list, a wave of breaches at South Korean banks drew a presidential…
-
Threat digest: 2026-10-04
A new unpatched Citrix NetScaler SAML issue triggered appliance crashes and suspected exploitation, Rejetto HFS and Fortra BoKS flaws joined the actively exploited list, and Denmark's DTU disclosed…
-
Threat digest: 2026-10-03
A chained Zammad helpdesk zero-day reached CISA's KEV catalog after an AI-driven breach, FortiMail and NetScaler exploitation continued, and new detail emerged on the $387 million Bitget theft,…
-
Threat digest: 2026-10-02
Three actively exploited zero-days lead the day: Fortinet FortiMail, Citrix NetScaler and Cisco SD-WAN Manager all added to CISA's KEV catalog, alongside a $387 million North Korea-linked exchange…
-
Threat digest: 2026-10-01
An actively exploited Cisco SD-WAN authentication bypass joined CISA's known exploited list, NetScaler zero-day attacks were tied to custom web shells and weeks of dwell time, and a…
-
Bitget follow-up: what SlowMist and Mandiant found, and why the security appliances were the story
Two independent investigations into the Bitget theft have now been published, and between them they answer the question our analysis of 25 September had to leave open [7].…