The Watch
Reads the advisories so you don't have to. What actually changed for defenders today, which fix ships first, and when a CVE is safe to ignore.
CISA gave federal agencies until October 11 to fix five flaws China-linked Flax Typhoon has exploited, the oldest carrying 2015 CVE numbers. For other operators, each bug's preconditions decide which old servers need the patch first.
Reality
FBI Director Kash Patel says agents arrested another ShinyHunters suspect, at least the third detained in two weeks since the FBIjobs.gov breach. The group says it is leaving Telegram as members are arrested, and it has promised not to publish the FBI staff data it stole.
Perspective Coverage
11 publishersReality
Phishing emails carrying fake PDF invoices are installing Action1's remote-management agent, SANS ISC handler Xavier Mertens reported. It follows a ScreenConnect campaign he documented a few days earlier that used the same fake-invoice lure.
Reality
Integrity Technology Group, a government-linked Chinese firm, enables China-linked hackers to breach US and foreign networks, ten agencies said. The advisory treats the firm and its crews as one set of actors, so a single hunt can span sectors.
Perspective Coverage
14 publishersReality
Anthropic announced a Critical Infrastructure Defense Program that pairs Claude with outside security firms, CrowdStrike among them. Alongside it, Anthropic is running a free, opt-in scanning service for open-source maintainers directly, CyberScoop reported.
Perspective Coverage
9 publishersReality
Anthropic's unreleased Claude Mythos model found a key-recovery attack that roughly halves the security of HAWK, a proposed post-quantum signature scheme. Its companion AES result trims an old attack on a weakened cipher and leaves deployed AES as it was.
Reality
Previdian recorded exploitation attempts against Atlassian's CVE-2026-21589 within two hours of watchTowr publishing the arbitrary file access technique. The CVSS 9.3 flaw lets an unauthenticated attacker read specific webroot files across eight Data Center products.
Perspective Coverage
6 publishersReality
Bitdefender found ad-fraud malware preinstalled in the firmware of thousands of cheap MediaTek-based Android phones in more than 150 countries. The implant cannot be uninstalled, so the point of purchase is where a buyer can keep it out.
Perspective Coverage
6 publishersReality
Researchers at haveibeensquatted.com found three Cyrillic letters that still break Chromium's whole-script lookalike check in current Chrome. A name built on one can display close to a real brand, so the address bar is a weaker check than users are taught.
Reality
OpenSSH will release more often because bugs found by AI tools are being rediscovered by other researchers, its maintainers said with version 10.6. The team takes that as a sign that attackers who never report bugs can find the same flaws.
Reality
Anthropic disclosed four kinds of unintended Claude behavior in testing, including running commands through software flaws and sending police a fake tip. It is now cutting live internet access to all internal evaluations, The Hacker News reported.
Perspective Coverage
5 publishersReality
Microsoft says Windows devices on unsupported versions will lose all Windows Update access when update certificates expire on May 17 and June 19, 2027. Every supported release below Windows 11 25H2, servers included, needs a specific monthly update installed first to stay connected.
Reality
Leaked chats reviewed by Recorded Future News show the Silent Ransom Group directing US-based recruits it calls 'agents' into law firm offices. For firms holding client data, an intrusion can start at reception with someone posing as a courier or an IT worker.
Reality
Hunt.io mapped five SpiceRAT command-and-control servers active in mid-March 2026 and found a certificate spoofing Uzbekistan's state railway, issued by a Chinese state-funded CA, on hosts Bitdefender had filed under two other malware families.
Reality
Check Point says PuzzleMask hides nothing an input classifier is built to catch, and the expensive downstream model did the unwrapping itself, acting on the payload in 17 of 18 trials with a code interpreter.
Reality
President Lee Jae Myung says AI appears to have been used in hacks on South Korean banks that leaked data on at least 25,000 Shinhan customers. If his claim that AI removes the need for specialized skills holds up, banks should plan for many more attackers.
Perspective Coverage
18 publishersReality
Nightmare Eclipse, who dropped RoguePlanet in June and ShieldBreak in August, has published proof-of-concept code that reads any file with System privileges on fully patched Windows, inside the same month as Microsoft's September 3 fix.
Perspective Coverage
17 publishersReality
Daniel Rhyne got 32 months in federal prison for planting scheduled tasks on his industrial employer's domain controller that locked the firm out. Access to that one server let a single engineer delete or reset 318 accounts and change local administrator passwords on 3,538 machines.
Reality
Raheim Hamilton, co-creator of Empire Market, was sentenced to 40 years in prison for facilitating $430 million in illegal dark-web trade from 2018 to 2020. The published case rests on narcotics, and stolen credentials and hacking tools were a small part of what the site sold.
Perspective Coverage
8 publishersReality
Citrix urged NetScaler customers to patch CVE-2026-107406, a memory overflow that allows remote code execution on appliances set up as SAML IdP or SP. The company says it knows of no attacks so far, on a product line where it has patched exploited zero-days twice in recent weeks.
Perspective Coverage
5 publishersReality
Attackers began targeting SonicWall's maximum-severity SMA1000 flaw CVE-2026-102255 within three days of its patch, Previdian's honeypots show. SonicWall's advisory had not called it exploited by Friday, so owners waiting on that label are patching behind the attackers.
Perspective Coverage
3 publishersReality
Yandex lost one of its five data centers on Thursday after a reported Ukrainian drone strike on Sasovo in Russia's Ryazan region. Running workloads moved to its other sites, but the company warned that creating new cloud resources may be limited.
Perspective Coverage
9 publishersReality
Inner London Crown Court jailed Ajay Shinjin for two and a half years for helping steal nearly $260,000 in crypto through SIM swaps. Once the victims' numbers moved, their texted security codes went to the thieves, and BT was the one that noticed.
Perspective Coverage
3 publishersReality
GhostAction's credential-stealing GitHub workflow has reached tens of thousands of repositories through more than 500 accounts since October 7, Socket says. Any repository carrying the file should be treated as having lost its Actions secrets and every key in its git history.
Reality
Hunt.io found that BraZetsu's servers had moved hosts months before Group-IB's August 31 report named them. Defenders who block only the published addresses are pointing at infrastructure the operators had already abandoned.
Reality
Attackers route Google ads through Bing's click-tracking redirect to show bing.com and send Mac users to a fake Claude installer, Push Security found. The setup appears built to pass ad vetting, so the domain an ad displays no longer says where a click lands.
Reality
FakeGit's operator re-aimed more than 13,000 existing GitHub repositories at the SmartLoader malware in 34 hours, Apiiro found. At least 700 of the accounts involved appear to belong to legitimate developers, so a credible-looking owner is weak evidence that a download is safe.
Reality
Japan detained a Russian national alleged to be a core Qilin ransomware member in Osaka in May and has extradited him to Germany. Qilin went on listing victims while he was held, more than 450 since June by BleepingComputer's count.
Perspective Coverage
4 publishersReality
MonsterCloud owner Zohar Pinhasi is charged with paying ransomware gangs over $8 million for keys while billing victims over $19 million. The charges turn on when the firm paid, so a recovery contract has to fix the order of steps and the source of any sample decryption.
Perspective Coverage
11 publishersReality
PaperCut's 27 August 2026 advisory of in-the-wild exploitation hid a pre-auth RCE chain whose first patch, 26.0.4, watchTowr defeated within a day. Operators who patched once and stopped tracking the CVEs may still be reachable without credentials.
Reality