Video
ZERO-DAYSeptember 14, 2026
GitLab CVE-2026-85706: Unauthenticated Path Traversal Exposes SSH Keys and CI/CD Secrets
Read
Daily Briefing · Updated Every Morning
Daily Cybersecurity Briefing for Security Practitioners: Your security day
starts here.
Actionable threat intelligence, delivered daily.
✓Detection Rules✓Hunt Queries✓WAF Rules✓IOC Tables✓Remediation Steps
Free. No spam. Trusted by 50,000+ practitioners. Unsubscribe anytime.
New subscribers also get: The Mythos Brief (AI zero-day research, free)
50K+
Practitioners
7 Days
7 Themes
<4hr
Alert Latency
Giveaway: Win an All Access InfoSec World 2026 pass, valued at $3,895. Subscribe to enter. Free.
What We CoverOne threat. One action.
One threat. One action.
Every morning.
We monitor hundreds of sources across every threat category. Each morning we identify the single most critical, most actionable threat and tell you exactly what to do about it.
Zero-Day Exploits
When a new exploitable vulnerability emerges before a patch exists, we cover it the morning your window to act opens.
Ransomware Campaigns
Active ransomware groups, fresh victims, TTPs in play, and the sectors in the crosshairs right now.
Nation-State Operations
APT activity, espionage campaigns, and state-sponsored attacks with enough detail for defenders to act.
Critical Exposures
Misconfigurations, credential leaks, and open attack surface gaps that leave your organization visible to attackers.
Active Phishing Campaigns
Credential-harvesting operations targeting your sector, including AI-enhanced and business email compromise attacks.
Supply Chain Threats
Compromised packages, vendor incidents, and third-party risk events with real downstream blast radius.
Sponsored
Proactive Security for the AI Era
NodeZero continuously and autonomously pentests infrastructure, identity, cloud, and now web applications, chaining weaknesses across every domain the way real attackers do. Every finding ships with replayable proof showing exploitable business impact, not theoretical risk.
Latest IntelLatest critical
Latest critical
threat intel
Active Threat
ACTIVE CAMPAIGNSeptember 15, 2026
JFrog Artifactory Supply Chain Attack: 3 CVEs Chained to Plant Backdoors Across Dev Pipelines
JFrog Artifactory supply chain attack chained 3 CVEs. Attackers forge admin tokens, plant Rust backdoors. Patching alone won't revoke their access.
11 min readSources: JFrog Security Advisory: CVE-2026-82329 Platforms Vulnerabilities, CISA Adds Seven Known Exploited Vulnerabilities to Catalog (September 2, 2026), The Hacker News: Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors, Bishop Fox: CVE-2026-82329 Unauthenticated Administrative Access in JFrog Artifactory via Empty Cluster Join Key, BleepingComputer: Artifactory flaws chained in attacks deploying backdoor malware, SecurityWeek: Three JFrog Artifactory Flaws Exploited for Backdoor Deployment
CVSS 9.8
Severity score for CVE-2026-82329, the authentication bypass that allows an unauthenticated attacker to forge a JWT using a blank HMAC secret and receive a fully-scoped Artifactory administrator token with a single POST request requiring no credentials and no prior foothold
49%
Percentage of internet-exposed self-hosted JFrog Artifactory instances that remained unpatched two weeks after JFrog released fixed versions on August 28, 2026, leaving nearly half of all vulnerable deployments open to active exploitation by threat actors who have already demonstrated working exploit code
4 days
Time between JFrog releasing patches on August 28, 2026, and watchTowr confirming active exploitation attempts starting September 1, 2026. Attackers reverse-engineered the fix and weaponized CVE-2026-82329 within four days of patch publication, well inside most organizations' patch approval cycles
0 tokens revoked
Admin tokens revoked by patching alone. JFrog confirmed that upgrading to a fixed version does not invalidate tokens already minted by attackers and does not rotate a cluster join key already captured. Organizations that patch without forensic triage may believe they are clean while attacker-created tokens and backdoor accounts remain fully functional
Browse:ZERO-DAYACTIVE CAMPAIGNPATCH BEFORE EODYOUR EXPOSURE TODAYAI WEAPONIZEDKNOW YOUR ENEMYNATION-STATESUPPLY CHAINAll →
Video
ZERO-DAYSeptember 13, 2026
MikroTrick Exploited: 122,500 RouterOS Devices Exposed to SSH Auth Bypass Chain
Read
Video
ACTIVE CAMPAIGNSeptember 12, 2026
WatchGuard Firebox CVE-2025-14733: Ransomware Gangs Actively Exploiting 9,000 Unpatched Devices
Read
Video
CLOSE THIS GAPSeptember 11, 2026
CVE-2025-25249: 178 FortiGate Devices Compromised by AI-Built PivotC2 RAT
Read
1612 briefings published · full archive of every threat intelligence report.
Browse All IntelligenceSecurity Advisory · Updated September 2026
The AI That Finds 27-Year-Old
Zero-Days Is Already Running.
Anthropic's Project Glasswing red team confirmed autonomous zero-day discovery across every major OS and browser, with some bugs buried for over two decades. Updated September 2026: Checkmarx just became the latest partner to join (Sept 3), on top of 200+ organizations and 10,000+ high-severity findings. Most vulnerabilities are still unpatched.
21/41
V8 ACEs in ExploitBench; no other model scored above zero
10.5×
More exploits than Opus 4.6 (ExploitGym benchmark)
$35M
Smart contract value identified in SCONE-Bench
What's inside the brief
- 9 confirmed CVEs: FreeBSD RCE, OpenBSD DoS, FFmpeg corruption, Linux LPE, VMM escape, browser JIT, V8 ACE, smart contracts
- Three independent benchmarks: ExploitBench (21/41 ACEs), ExploitGym (10.5x), SCONE-Bench ($35M); all vs zero or near-zero for other models
- Why Mythos finds 17- and 27-year-old bugs that survived decades of expert review
- Four specific defensive actions from Anthropic's red team: patch cycle, IR pipeline, AI-assisted defense, and disclosure posture
- How to monitor Project Glasswing disclosures before weaponized exploits hit the wild
Free Practitioner Brief
Claude Mythos Preview: What Security Teams Need to Know Now
Sourced from Anthropic's Project Glasswing red team assessment (April 2026) and Exploit Evals benchmark report (May 2026), updated with Checkmarx's Project Glasswing partnership announcement (September 2026). Written for security engineers and CISOs. No vendor pitches, no padding.
You'll also receive the Decryption Digest: daily threat intelligence for practitioners. Unsubscribe any time.
Already subscribed? Go directly to the brief →
Trusted by 50,000+ SOC analysts, CISOs, and security engineers
Free resources
25
Free download
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Free download
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
The ProblemEvery morning, your team
Every morning, your team
is already behind.
The threat landscape doesn't pause overnight. By the time you open your laptop, actors have moved, disclosures have dropped, and your patching window is narrowing. Most security teams are playing catch-up before 9am.
No Clear Daily Priority
Your SIEM fires thousands of alerts before breakfast. Critical CVEs get buried. By the time triage completes, the patching window has already closed. Threat actors have already moved.
Intel That Arrives Too Late
Threat actors exploit within hours of disclosure. Your intelligence pipeline takes days. Every hour that gap exists, your exposure grows. Speed is the metric that matters.
A Dozen Sources, Zero Context
NVD, vendor advisories, dark web forums, OSINT feeds. Your analysts juggle it all with no unified view. Priority becomes guesswork. Context gets lost.
Lean Team, Infinite Surface
The skills gap is real. Your team can't cover every advisory, every CVE, every active campaign. Without a daily brief that cuts the signal for you, something always slips through.
Included with every briefing
Not linked to another page. Not summarised. Included.
Sigma Detection Rules
Deploy-ready YAML matched to the threat — convert to Splunk, Sentinel, or Elastic with sigma-cli.
WAF Rules — 4 Platforms
ModSecurity, Cloudflare, AWS WAF, and Azure Front Door rules targeting the specific exploit pattern.
IOC Tables
Behavioral, network, and host indicators — copy directly into your SIEM or threat intel platform.
Remediation Steps
Verb-first, prioritized, time-bound. Patch step 1 links directly to the vendor advisory.
The SolutionIntelligence your team
Intelligence your team
can act on before 9am.
Decryption Digest is not a news aggregator. It's a practitioner's action guide, delivered daily, focused on the single most critical threat, and built to give your team a clear mission the moment they start their day.
Sample Analysis: CVE Exploit Path Mapping
Curated, Not Automated
Every briefing is reviewed for accuracy and real-world impact. No AI hallucinations. No vendor marketing. Just verified intelligence you can trust.
One Signal. Not a Roundup.
Every morning we identify the single most critical, most actionable threat and tell you exactly what to do. Not a theme, not a list — the one thing that demands your attention today.
Real-Time Delivery
Critical alerts reach you within hours of disclosure, not days. Our monitoring pipeline covers NVD, advisories, exploit databases, dark web chatter, and live campaign tracking.
Strategic Prioritization
CVSS scores miss the point. We factor in active exploitation, threat actor targeting, industry context, and exploit maturity. So you act on what's actually dangerous, not just theoretically risky.
Scannable in Under 5 Minutes
No 40-page PDFs. Each briefing is structured for fast consumption: the key facts, the affected systems, the remediation steps. Read it before your standup.
Zero Noise Guarantee
If it's not actively exploited or doesn't pose imminent risk, it doesn't make the cut. Your inbox only carries what demands your attention today.
How It WorksFrom threat disclosure
From threat disclosure
to your morning action list
Digest Sample: Ransomware Campaign Analysis
LIVE PREVIEW01
We Monitor the Threat Landscape
Our pipeline runs 24/7 across NVD, vendor advisories, exploit databases, threat actor forums, and dark web sources. Nothing critical goes undetected overnight.
02
We Triage by Real-World Impact
Automated triage plus expert analysis. We assess active exploitation, affected industries, and remediation complexity, not just CVSS scores.
03
We Pick the One That Matters
We identify the single most critical, most actionable threat from everything we monitored. One post. One clear action. No triage required on your end.
04
You Start the Day Ahead
Your team opens the briefing, knows exactly what to act on, and briefs leadership with confidence. Not reactive. Not overwhelmed. Ready.
TestimonialsTrusted by security teams
Trusted by security teams
at every scale
Trusted by security teams across industries
Fortune 500 EnterpriseFederal AgencyRegional BankHealthcare SystemMSSPTech Unicorn
“
Decryption Digest cut our mean time to remediate by 40%. We patch what matters first now, instead of chasing every advisory.
SC
Sarah C.
CISO, Regional Financial Services Group
“
I used to spend 2 hours every morning triaging threat feeds. Now I spend 5 minutes reading the digest and my day starts with clarity.
MO
Marcus O.
Senior Security Engineer, Fortune 500 Cloud Infrastructure
“
The remediation context is what sets this apart. It's not just 'here's a CVE.' It's 'here's what to do about it and why it matters for your stack.'
EV
Elena V.
Director of Security Operations, Enterprise SaaS Platform
About UsBuilt by defenders,
Team of 12+ security researchers
Built by defenders,
for defenders
Decryption Digest was born from a simple frustration: security teams spending more time parsing intel than acting on it. Founded by veteran threat analysts and incident responders, we built the briefing we always wished we had.
Our team combines deep expertise in vulnerability research, threat hunting, and security operations. We've worked the SOC floors, led red teams, and managed enterprise security programs. We know what matters because we've lived it.
TC
RK
AJ
NP
10+
Years in Threat Intelligence
200+
CVEs Analyzed Monthly
50K+
Practitioners Subscribed
48
Countries Covered
Join 50,000+ PractitionersTomorrow morning,
Tomorrow morning,
know exactly what to do.
Every day has a purpose. Every briefing drives action. Join 50,000+ SOC analysts, CISOs, and security engineers who start their day with Decryption Digest, the daily security briefing built for practitioners, not executives.
Free. No credit card. Trusted by teams at Fortune 500 companies. Unsubscribe anytime.