en
FortiBleed: 73,932 Fortinet Firewalls Compromised — Credential Extraction Campaign Analysis
Global telemetry analysis of FortiBleed: mass unauthenticated credential extraction targeting 73,932 Fortinet appliances.
Latest
en
Mastra npm Supply Chain: easy-day-js Typosquat Delivers Cross-Platform RAT to 144 Packages
How typosquatted npm packages targeting the Mastra AI agent framework infected 144 downstream enterprise packages with a cross-platform RAT.
en
JetBrains Marketplace AI Key Theft — 15 Malicious Plugins, 70K Installs, TLS Bypass
Security breakdown of 15 malicious JetBrains IDE plugins stealing OpenAI, Anthropic, and AWS API keys from 70,000 developers.
en
DragonForce Backdoor.Turn — Microsoft Teams TURN Relay C2: Attack Chain & Detection
How DragonForce ransomware operators abused Microsoft Teams TURN server relays to bypass firewall egress filtering for C2 traffic.
en
CVE-2026-20262: Cisco SD-WAN Manager Zero-Day — Path Traversal to Root + CISA KEV
Technical root cause and remediation for the actively exploited Cisco SD-WAN Manager path traversal flaw.
en
Security Roundup: Oracle PeopleSoft Zero-Day, June Patch Tuesday, Chrome V8 Exploit, TanStack Supply Chain — Week of June 12, 2026
Weekly briefing: Oracle PeopleSoft zero-day exploited by ShinyHunters, Chrome V8 in-browser RCE, and TanStack Mini Shai-Hulud worm.
en
CVE-2026-25089: FortiSandbox Unauthenticated RCE + CISA KEV June 9 Additions (Arista, Cisco SD-WAN)
Technical root cause for the unauthenticated OS command injection vulnerability in Fortinet FortiSandbox appliances.
en
TanStack npm "Mini Shai-Hulud" Supply Chain Worm — TeamPCP Attack Chain, IOCs & Full Remediation
How threat actor TeamPCP deployed the Mini Shai-Hulud worm to poison TanStack packages and compromise developer build environments.
en
CVE-2026-11645: Chrome V8 Zero-Day — OOB Read/Write In-Browser RCE Analysis
Technical analysis of the Chrome V8 out-of-bounds read/write memory corruption zero-day exploited in targeted surveillance campaigns.
en
Microsoft June 2026 Patch Tuesday Deep Dive — YellowKey, GreenPlasma, CTFMON EoP & Record 200+ CVEs
Technical deep dive into Microsoft June 2026 Patch Tuesday addressing over 200 CVEs including YellowKey BitLocker bypass.
en
CVE-2026-35273: Oracle PeopleSoft Zero-Day — ShinyHunters UNC6240 Attack Chain & Remediation
How ShinyHunters weaponized an unauthenticated Oracle PeopleSoft zero-day to exfiltrate employee records across Fortune 500 firms.
en
Security Roundup: Netlogon 0-Click RCE, Citrix NetScaler SAML Exploit, TeamPCP Supply Chain, Android Zero-Day — Week of June 4, 2026
Weekly briefing: Windows Netlogon 0-click DC takeover, Citrix NetScaler SAML memory overread, and TeamPCP supply chain backdoor.