Project
Publisher of the Stormcast podcast and the ISC diaries summarized in the episode.
Phishing emails carrying fake PDF invoices are installing Action1's remote-management agent, SANS ISC handler Xavier Mertens reported. It follows a ScreenConnect campaign he documented a few days earlier that used the same fake-invoice lure.
Reality
Previdian recorded exploitation attempts against Atlassian's CVE-2026-21589 within two hours of watchTowr publishing the arbitrary file access technique. The CVSS 9.3 flaw lets an unauthenticated attacker read specific webroot files across eight Data Center products.
Perspective Coverage
6 publishersReality
Outlaw/Dota's 2022-era SSH client produced 618 sessions on one Cowrie honeypot in late September 2026, while a new client generation produced 3. A detection rule holding only the hassh published in May would have matched none of the 618.
Reality
Microsoft's July update fixes 622 vulnerabilities, 62 of them rated critical. The two it says attackers are already using, in AD FS and SharePoint Server, sit below that line, so exploited status has to order the work.
Reality
A single Stormcast episode carries a Keycloak 26.7.2 password-reset fix, a reported N-able password manager leak, and a published LLM safeguard bypass. Most of it sits in the identity and secrets tier.
Reality