Video
AI WEAPONIZEDNovember 12, 2026
Operation Snowball: Jailbroken DeepSeek AI Agent Runs 14-Day Autonomous Intrusion Into European Telecom
Read
Daily Briefing · Updated Every Morning
Daily Cybersecurity Briefing for Security Practitioners: Your security day
starts here.
Actionable threat intelligence, delivered daily.
✓Detection Rules✓Hunt Queries✓WAF Rules✓IOC Tables✓Remediation Steps
Free. No spam. Trusted by 50,000+ practitioners. Unsubscribe anytime.
New subscribers also get: The Mythos Brief (AI zero-day research, free)
50K+
Practitioners
7 Days
7 Themes
<4hr
Alert Latency
Reach 50,000+ security professionals
Sponsor a newsletter slot and put your brand in front of CISOs, engineers, and IT decision-makers.
Latest IntelLatest critical
Latest critical
threat intel
Active Threat
CLOSE THIS GAPNovember 13, 2026
wfx-loot: 4,837 GitHub Accounts Weaponized to Steal CI/CD Cloud Credentials
wfx-loot hijacked 4,837 GitHub accounts to steal CI/CD cloud credentials that persist past token rotation across 61,764 repos. Audit and rotate now.
10 min readSources: wfx-loot: Stolen GitHub Tokens Pushed a CI Secret Stealer into 60,000+ Repositories -- Chainguard, wfx-loot 2026: 4,800 GitHub Accounts Hijacked to Steal Cloud Credentials -- Aviatrix, Hijacked GitHub Accounts Push 'wfx' CI Secret Stealer to Thousands of Repositories -- Endor Labs, Check Your GitHub Repos: A Secret Stealer Hit Tens of Thousands of Them -- Help Net Security, Security Hardening for GitHub Actions -- GitHub Docs
4,837
GitHub accounts hijacked by wfx-loot attackers to inject the CI secret-stealing payload via malicious pull requests
61,764
repositories probed via malicious pull requests in under 48 hours, making this the largest GitHub Actions supply chain attack on record
1,806
repositories confirmed to have executed the payload and had AWS, Azure, GCP, and AI platform credentials exfiltrated
89.6%
of large organizations worldwide have at least one employee credential captured by infostealer malware, feeding the access economy that powers attacks like wfx-loot
Browse:ZERO-DAYACTIVE CAMPAIGNPATCH BEFORE EODYOUR EXPOSURE TODAYAI WEAPONIZEDKNOW YOUR ENEMYNATION-STATESUPPLY CHAINAll →
Video
ZERO-DAYNovember 11, 2026
CVE-2026-124194: Actively Exploited Outlook Zero-Day Leaks NTLM Hashes -- Patch Office, Not Just Windows
Read
Video
ZERO-DAYNovember 10, 2026
Barracuda ESG CVE-2026-116606 Pre-Auth Chain Gives Root Access to Email Security Gateways
Read
Video
ACTIVE CAMPAIGNNovember 9, 2026
CWPdoor: Trojanized cwpsrv Binary Gives Attackers Root on 340,000 Linux Servers
Read
1705 briefings published · full archive of every threat intelligence report.
Browse All IntelligenceWhat We CoverOne threat. One action.
One threat. One action.
Every morning.
We monitor hundreds of sources across every threat category. Each morning we identify the single most critical, most actionable threat and tell you exactly what to do about it.
Zero-Day Exploits
When a new exploitable vulnerability emerges before a patch exists, we cover it the morning your window to act opens.
Ransomware Campaigns
Active ransomware groups, fresh victims, TTPs in play, and the sectors in the crosshairs right now.
Nation-State Operations
APT activity, espionage campaigns, and state-sponsored attacks with enough detail for defenders to act.
Critical Exposures
Misconfigurations, credential leaks, and open attack surface gaps that leave your organization visible to attackers.
Active Phishing Campaigns
Credential-harvesting operations targeting your sector, including AI-enhanced and business email compromise attacks.
Supply Chain Threats
Compromised packages, vendor incidents, and third-party risk events with real downstream blast radius.
Security Advisory · Updated October 2026
The AI That Finds 27-Year-Old
Zero-Days Is Already Running.
Anthropic's Project Glasswing red team confirmed autonomous zero-day discovery across every major OS and browser, with some bugs buried for over two decades. Updated October 2026: Mythos 5.1 is now in limited release via the Cyber Verification Program; Bank of America spent $200M+ in Q3 patching Mythos-found flaws using 4,000 workers. Most vulnerabilities across 200+ partner organizations are still unpatched.
21/41
V8 ACEs in ExploitBench; no other model scored above zero
10.5×
More exploits than Opus 4.6 (ExploitGym benchmark)
$35M
Smart contract value identified in SCONE-Bench
What's inside the brief
- 9 confirmed CVEs: FreeBSD RCE, OpenBSD DoS, FFmpeg corruption, Linux LPE, VMM escape, browser JIT, V8 ACE, smart contracts
- Three independent benchmarks: ExploitBench (21/41 ACEs), ExploitGym (10.5x), SCONE-Bench ($35M); all vs zero or near-zero for other models
- Why Mythos finds 17- and 27-year-old bugs that survived decades of expert review
- Four specific defensive actions from Anthropic's red team: patch cycle, IR pipeline, AI-assisted defense, and disclosure posture
- How to monitor Project Glasswing disclosures before weaponized exploits hit the wild
Free Practitioner Brief
Claude Mythos Preview: What Security Teams Need to Know Now
Sourced from Anthropic's Project Glasswing red team assessment (April 2026), Exploit Evals benchmark report (May 2026), and October 2026 developments including Mythos 5.1 release and Bank of America Q3 earnings disclosure. Written for security engineers and CISOs. No vendor pitches, no padding.
You'll also receive the Decryption Digest: daily threat intelligence for practitioners. Unsubscribe any time.
Already subscribed? Go directly to the brief →
Trusted by 50,000+ SOC analysts, CISOs, and security engineers
Free resources
25
Free download
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Free download
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
The ProblemEvery morning, your team
Every morning, your team
is already behind.
The threat landscape doesn't pause overnight. By the time you open your laptop, actors have moved, disclosures have dropped, and your patching window is narrowing. Most security teams are playing catch-up before 9am.
No Clear Daily Priority
Your SIEM fires thousands of alerts before breakfast. Critical CVEs get buried. By the time triage completes, the patching window has already closed. Threat actors have already moved.
Intel That Arrives Too Late
Threat actors exploit within hours of disclosure. Your intelligence pipeline takes days. Every hour that gap exists, your exposure grows. Speed is the metric that matters.
A Dozen Sources, Zero Context
NVD, vendor advisories, dark web forums, OSINT feeds. Your analysts juggle it all with no unified view. Priority becomes guesswork. Context gets lost.
Lean Team, Infinite Surface
The skills gap is real. Your team can't cover every advisory, every CVE, every active campaign. Without a daily brief that cuts the signal for you, something always slips through.
Included with every briefing
Not linked to another page. Not summarised. Included.
Sigma Detection Rules
Deploy-ready YAML matched to the threat — convert to Splunk, Sentinel, or Elastic with sigma-cli.
WAF Rules — 4 Platforms
ModSecurity, Cloudflare, AWS WAF, and Azure Front Door rules targeting the specific exploit pattern.
IOC Tables
Behavioral, network, and host indicators — copy directly into your SIEM or threat intel platform.
Remediation Steps
Verb-first, prioritized, time-bound. Patch step 1 links directly to the vendor advisory.
The SolutionIntelligence your team
Intelligence your team
can act on before 9am.
Decryption Digest is not a news aggregator. It's a practitioner's action guide, delivered daily, focused on the single most critical threat, and built to give your team a clear mission the moment they start their day.
Sample Analysis: CVE Exploit Path Mapping
Curated, Not Automated
Every briefing is reviewed for accuracy and real-world impact. No AI hallucinations. No vendor marketing. Just verified intelligence you can trust.
One Signal. Not a Roundup.
Every morning we identify the single most critical, most actionable threat and tell you exactly what to do. Not a theme, not a list — the one thing that demands your attention today.
Real-Time Delivery
Critical alerts reach you within hours of disclosure, not days. Our monitoring pipeline covers NVD, advisories, exploit databases, dark web chatter, and live campaign tracking.
Strategic Prioritization
CVSS scores miss the point. We factor in active exploitation, threat actor targeting, industry context, and exploit maturity. So you act on what's actually dangerous, not just theoretically risky.
Scannable in Under 5 Minutes
No 40-page PDFs. Each briefing is structured for fast consumption: the key facts, the affected systems, the remediation steps. Read it before your standup.
Zero Noise Guarantee
If it's not actively exploited or doesn't pose imminent risk, it doesn't make the cut. Your inbox only carries what demands your attention today.
How It WorksFrom threat disclosure
From threat disclosure
to your morning action list
Digest Sample: Ransomware Campaign Analysis
LIVE PREVIEW01
We Monitor the Threat Landscape
Our pipeline runs 24/7 across NVD, vendor advisories, exploit databases, threat actor forums, and dark web sources. Nothing critical goes undetected overnight.
02
We Triage by Real-World Impact
Automated triage plus expert analysis. We assess active exploitation, affected industries, and remediation complexity, not just CVSS scores.
03
We Pick the One That Matters
We identify the single most critical, most actionable threat from everything we monitored. One post. One clear action. No triage required on your end.
04
You Start the Day Ahead
Your team opens the briefing, knows exactly what to act on, and briefs leadership with confidence. Not reactive. Not overwhelmed. Ready.
TestimonialsTrusted by security teams
Trusted by security teams
at every scale
Trusted by security teams across industries
Fortune 500 EnterpriseFederal AgencyRegional BankHealthcare SystemMSSPTech Unicorn
“
Decryption Digest cut our mean time to remediate by 40%. We patch what matters first now, instead of chasing every advisory.
SC
Sarah C.
CISO, Regional Financial Services Group
“
I used to spend 2 hours every morning triaging threat feeds. Now I spend 5 minutes reading the digest and my day starts with clarity.
MO
Marcus O.
Senior Security Engineer, Fortune 500 Cloud Infrastructure
“
The remediation context is what sets this apart. It's not just 'here's a CVE.' It's 'here's what to do about it and why it matters for your stack.'
EV
Elena V.
Director of Security Operations, Enterprise SaaS Platform
About UsBuilt by defenders,
Team of 12+ security researchers
Built by defenders,
for defenders
Decryption Digest was born from a simple frustration: security teams spending more time parsing intel than acting on it. Founded by veteran threat analysts and incident responders, we built the briefing we always wished we had.
Our team combines deep expertise in vulnerability research, threat hunting, and security operations. We've worked the SOC floors, led red teams, and managed enterprise security programs. We know what matters because we've lived it.
TC
RK
AJ
NP
10+
Years in Threat Intelligence
200+
CVEs Analyzed Monthly
50K+
Practitioners Subscribed
48
Countries Covered
Join 50,000+ PractitionersTomorrow morning,
Tomorrow morning,
know exactly what to do.
Every day has a purpose. Every briefing drives action. Join 50,000+ SOC analysts, CISOs, and security engineers who start their day with Decryption Digest, the daily security briefing built for practitioners, not executives.
Free. No credit card. Trusted by teams at Fortune 500 companies. Unsubscribe anytime.