Video
CLOSE THIS GAPJuly 17, 2026
Microsoft Patch Tuesday July 2026: 2 Zero-Days Exploited in Attacks, 570 Flaws Fixed
Read
Daily Briefing · Updated Every Morning
Daily Cybersecurity Briefing for Security Practitioners: Your security day
starts here.
Actionable threat intelligence, delivered daily.
Know what to act on before 9am.
Free. No spam. Trusted by 50,000+ practitioners. Unsubscribe anytime.
New subscribers also get: The Mythos Brief (AI zero-day research, free)
50K+
Practitioners
7 Days
7 Themes
<4hr
Alert Latency
Giveaway: Win a full-access Black Hat USA 2026 pass, valued at $2,495. Subscribe to enter. Free.
Daily Intel ScheduleKnow exactly what to act on
Know exactly what to act on
every single day.
Every day has a fixed theme, a specific focus, and a clear action for your role. No guessing what to read. No wasted triage time. Just the intel that matters today.
Mon
Intel Drop
Start the week informed.
View all →Tue
Patch Before EOD
Act on it today.
View all →Wed
Active Campaign
Your sector is being targeted.
View all →Thu
Your Exposure Today
Check your org's dark web presence.
View all →Fri
Close This Gap
Fix it before the weekend.
View all →Sat
AI Weaponized Against You
Watch what's evolving.
View all →Sun
Know Your Enemy
Prep for the week ahead.
View all →Sponsored
Retool's new app builder is where AI-generated code ships safely
Building apps with AI is easy. Getting them to production safely is another story.
Latest IntelLatest critical
Latest critical
threat intel
Active Threat
AI WEAPONIZEDJuly 18, 2026
AI-Generated 'Vibe-Coded' Malware Caught Mapping Active Directory in Live Attack
A threat actor vibe-coded a PowerShell AD recon script using an LLM, mapped an entire domain in 30 minutes, and exfiltrated the data with zero antivirus detections.
10 min readSources: Huntress: AI-Coded Malware: Analyzing Vibe-Coded AD Enumeration, The Hacker News: Attacker Uses Suspected AI-Generated PowerShell Script to Map Active Directory, Unit 42: 2026 Global Incident Response Report, CrowdStrike: 2026 Global Threat Report
75%
Reduction in attacker time-to-exfiltration for the fastest AI-assisted intrusions (Unit 42 2026 IR Report)
89%
Increase in AI-enabled adversary attacks year-over-year (CrowdStrike 2026 Global Threat Report)
30 min
Total time from RDP access to complete Active Directory enumeration and S3 exfiltration in the June 3 intrusion
0
Antivirus detections on the vibe-coded script: every AI-generated tool arrives with a unique, never-indexed hash
Browse:MONDAY INTEL DROPPATCH BEFORE EODACTIVE CAMPAIGNYOUR EXPOSURE TODAYCLOSE THIS GAPAI WEAPONIZEDKNOW YOUR ENEMYCVE REFERENCEAll →
Video
YOUR EXPOSURE TODAYJuly 16, 2026
Aflac Japan Data Breach Exposes 4.38 Million Customers: Bank Accounts and PII Stolen
Read
Video
ACTIVE CAMPAIGNJuly 15, 2026
SonicWall SMA1000 Zero-Days CVE-2026-15409 Actively Exploited: Patch Before July 17
Read
Video
PATCH BEFORE EODJuly 14, 2026
CVE-2025-47981: Wormable Windows SPNEGO Flaw Tops Microsoft's July 2026 Patch Tuesday
Read
1348 briefings published · full archive of every threat intelligence report.
Browse All IntelligenceSecurity Advisory · Updated July 2026
The AI That Finds 27-Year-Old
Zero-Days Is Already Running.
Anthropic's Project Glasswing red team confirmed autonomous zero-day discovery across every major OS and browser, with some bugs buried for over two decades. Updated July 2026: 200+ partner organizations, 10,000+ high-severity findings, expanded to critical infrastructure sectors. Most vulnerabilities are still unpatched.
21/41
V8 ACEs in ExploitBench; no other model scored above zero
10.5×
More exploits than Opus 4.6 (ExploitGym benchmark)
$35M
Smart contract value identified in SCONE-Bench
What's inside the brief
- 9 confirmed CVEs: FreeBSD RCE, OpenBSD DoS, FFmpeg corruption, Linux LPE, VMM escape, browser JIT, V8 ACE, smart contracts
- Three independent benchmarks: ExploitBench (21/41 ACEs), ExploitGym (10.5x), SCONE-Bench ($35M); all vs zero or near-zero for other models
- Why Mythos finds 17- and 27-year-old bugs that survived decades of expert review
- Four specific defensive actions from Anthropic's red team: patch cycle, IR pipeline, AI-assisted defense, and disclosure posture
- How to monitor Project Glasswing disclosures before weaponized exploits hit the wild
Free Practitioner Brief
Claude Mythos Preview: What Security Teams Need to Know Now
Sourced from Anthropic's Project Glasswing red team assessment (April 2026) and Exploit Evals benchmark report (May 2026). Written for security engineers and CISOs. No vendor pitches, no padding.
You'll also receive the Decryption Digest: daily threat intelligence for practitioners. Unsubscribe any time.
Already subscribed? Go directly to the brief →
Trusted by 50,000+ SOC analysts, CISOs, and security engineers
Free resources
25
Free download
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Free download
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
The ProblemEvery morning, your team
Every morning, your team
is already behind.
The threat landscape doesn't pause overnight. By the time you open your laptop, actors have moved, disclosures have dropped, and your patching window is narrowing. Most security teams are playing catch-up before 9am.
No Clear Daily Priority
Your SIEM fires thousands of alerts before breakfast. Critical CVEs get buried. By the time triage completes, the patching window has already closed. Threat actors have already moved.
Intel That Arrives Too Late
Threat actors exploit within hours of disclosure. Your intelligence pipeline takes days. Every hour that gap exists, your exposure grows. Speed is the metric that matters.
A Dozen Sources, Zero Context
NVD, vendor advisories, dark web forums, OSINT feeds. Your analysts juggle it all with no unified view. Priority becomes guesswork. Context gets lost.
Lean Team, Infinite Surface
The skills gap is real. Your team can't cover every advisory, every CVE, every active campaign. Without a daily brief that cuts the signal for you, something always slips through.
The SolutionIntelligence your team
Intelligence your team
can act on before 9am.
Decryption Digest is not a news aggregator. It's a practitioner's action guide, delivered daily, structured by theme, and built to give your team a clear mission the moment they start their day.
Sample Analysis: CVE Exploit Path Mapping
Curated, Not Automated
Every briefing is reviewed for accuracy and real-world impact. No AI hallucinations. No vendor marketing. Just verified intelligence you can trust.
Built Around Your Day
Seven fixed themes. Seven daily actions. Whether it's Tuesday's patch priority or Thursday's exposure check, you always know what to do today.
Real-Time Delivery
Critical alerts reach you within hours of disclosure, not days. Our monitoring pipeline covers NVD, advisories, exploit databases, dark web chatter, and live campaign tracking.
Strategic Prioritization
CVSS scores miss the point. We factor in active exploitation, threat actor targeting, industry context, and exploit maturity. So you act on what's actually dangerous, not just theoretically risky.
Scannable in Under 5 Minutes
No 40-page PDFs. Each briefing is structured for fast consumption: the key facts, the affected systems, the remediation steps. Read it before your standup.
Zero Noise Guarantee
If it's not actively exploited or doesn't pose imminent risk, it doesn't make the cut. Your inbox only carries what demands your attention today.
How It WorksFrom threat disclosure
From threat disclosure
to your morning action list
Digest Sample: Ransomware Campaign Analysis
LIVE PREVIEW01
We Monitor the Threat Landscape
Our pipeline runs 24/7 across NVD, vendor advisories, exploit databases, threat actor forums, and dark web sources. Nothing critical goes undetected overnight.
02
We Triage by Real-World Impact
Automated triage plus expert analysis. We assess active exploitation, affected industries, and remediation complexity, not just CVSS scores.
03
We Structure It for Your Day
Intelligence is matched to the day's theme. Tuesday's briefing tells you what to patch today. Thursday's shows your exposure. Every morning has a clear mission.
04
You Start the Day Ahead
Your team opens the briefing, knows exactly what to act on, and briefs leadership with confidence. Not reactive. Not overwhelmed. Ready.
TestimonialsTrusted by security teams
Trusted by security teams
at every scale
Trusted by security teams across industries
Fortune 500 EnterpriseFederal AgencyRegional BankHealthcare SystemMSSPTech Unicorn
“
Decryption Digest cut our mean time to remediate by 40%. We patch what matters first now, instead of chasing every advisory.
SC
Sarah C.
CISO, Regional Financial Services Group
“
I used to spend 2 hours every morning triaging threat feeds. Now I spend 5 minutes reading the digest and my day starts with clarity.
MO
Marcus O.
Senior Security Engineer, Fortune 500 Cloud Infrastructure
“
The remediation context is what sets this apart. It's not just 'here's a CVE.' It's 'here's what to do about it and why it matters for your stack.'
EV
Elena V.
Director of Security Operations, Enterprise SaaS Platform
About UsBuilt by defenders,
Team of 12+ security researchers
Built by defenders,
for defenders
Decryption Digest was born from a simple frustration: security teams spending more time parsing intel than acting on it. Founded by veteran threat analysts and incident responders, we built the briefing we always wished we had.
Our team combines deep expertise in vulnerability research, threat hunting, and security operations. We've worked the SOC floors, led red teams, and managed enterprise security programs. We know what matters because we've lived it.
TC
RK
AJ
NP
10+
Years in Threat Intelligence
200+
CVEs Analyzed Monthly
50K+
Practitioners Subscribed
48
Countries Covered
Join 50,000+ PractitionersTomorrow morning,
Tomorrow morning,
know exactly what to do.
Every day has a purpose. Every briefing drives action. Join 50,000+ SOC analysts, CISOs, and security engineers who start their day with Decryption Digest, the daily security briefing built for practitioners, not executives.
Free. No credit card. Trusted by teams at Fortune 500 companies. Unsubscribe anytime.