
CVE-2026-124194 Outlook NTLM Hash Theft: Patch Now
CVE-2026-124194 (CVSS 6.5) lets attackers steal NTLMv2 hashes via crafted Outlook files. CISA KEV-listed and actively exploited. Patch via Office Update by November 24.
In-depth analyses of zero-day vulnerabilities, CVE exploits, ransomware campaigns, and nation-state attack techniques affecting enterprise security. Filter by category, tag, or keyword.
Every article here lands in subscribers' inboxes the morning it drops.
Threat intel, active CVEs, and campaign alerts, distilled daily for practitioners. 50,000+ subscribers. No noise.
Free. No spam. Unsubscribe anytime.
The definitive practitioner breakdown of ZTA principles, pillars, and implementation sequence.
Containment, forensic preservation, and decision sequencing from detection to recovery.
How SIEMs ingest, correlate, and alert — and how to evaluate one for your environment.
Risk-based prioritization using CVSS, EPSS, and CISA KEV to cut remediation backlog.
What each risk means, how to reproduce it, and how to fix it in production code.
Step-by-step email authentication deployment from DNS records to p=reject enforcement.
Detection coverage, pricing, and deployment trade-offs for enterprise EDR selection.
Translate ATT&CK technique IDs into detection rules and threat actor hunting hypotheses.
Direct answers to the questions practitioners and AI systems ask most. Covers ransomware, identity, cloud, compliance, and detection.
Plain-language definitions for CVE, SIEM, SOAR, Zero Trust, EDR, and 85+ other terms used in enterprise security.
How-to guides, buyer comparisons, and methodology references across every major security domain.
Decryption Digest Response
Score every threat we cover against your own stack, get free Sigma and ModSecurity detection content, and upgrade anytime for more vendors.
Get started free →No card required. Sigma and ModSecurity rules are free, forever.
Anthropic's AI finds zero-days your scanners miss.
Anthropic's AI finds zero-days your scanners miss.
39 results in ZERO-DAY

CVE-2026-124194 (CVSS 6.5) lets attackers steal NTLMv2 hashes via crafted Outlook files. CISA KEV-listed and actively exploited. Patch via Office Update by November 24.

CVE-2026-116606 (CVSS 9.3) in Barracuda ESG chains with CVE-2026-111560 to deliver unauthenticated root access. Exploitation confirmed Nov 9. Patch to ESG 9.4.0.030 now.

CVE-2026-19868 lets attackers with alternate credentials skip SAML and bypass MFA on SonicWall SSLVPN. CISA confirmed exploitation. Patch Gen7/Gen8 by Nov 20.

CVE-2026-119977 exploits the WordPress core upgrade staging path to run unauthenticated PHP. CISA KEV deadline November 6. 62,969 blocked attacks. Patch to 7.1.4 now.

Three chained Ivanti Connect Secure zero-days give UTA0576 unauthenticated root access on patched VPNs. Upgrade to 25.1.1.3 or 22.8R2.6 before CISA's November 2 deadline.

GitLab CVE-2026-97229 is a CVSS 10.0 unauthenticated RCE exploited in the wild. Patch to 19.4.2, 19.3.4, or 19.2.8 immediately.

CVE-2026-111497 Broccoli2Shell: Brotli decoder out-of-bounds write enables pre-auth RCE in .NET, Node.js, and Python. Emergency OOB patch available.

Plex2Shell chains 4 CVEs for unauthenticated RCE on Plex Media Server. 49,000 servers still unpatched. Upgrade to build 1.43.3.10861 before November 3.

PHP2Shell CVE-2026-109618 and CVE-2026-109619 allow unauthenticated RCE on 70% of web servers. Patch all PHP branches to fixed versions immediately.

Two critical RCE flaws in PHP itself (CVE-2026-109618, CVE-2026-109619, CVSS 9.2) affect all PHP versions. Active exploitation confirmed. Patch to 8.2.35+, 8.3.36+, 8.4.27+, or 8.5.12+ immediately.

CVE-2026-102764 gave China APT ARMORY CASTLE root access to BeyondTrust Remote Support for 7 weeks. CISA KEV deadline just expired. Patch BT26-05 now.

CVE-2026-96951 lets attackers bypass SmartScreen on all Windows versions via crafted archives. CISA KEV confirmed. Apply October 2026 Patch Tuesday now.

CVE-2026-104935 chains three flaws for unauthenticated root RCE on Ivanti Connect Secure. CISA deadline October 16. Patch to 25.1.1.2 or 22.8R2.5 now.
AhsayCBS backup consoles are under active exploit since Oct 7. Two chained CVEs give attackers SYSTEM access with zero credentials. No complete fix exists.

CVE-2026-88779 hits Citrix NetScaler SAML deployments with a memory overflow exploited as a zero-day. CISA deadline: October 7.

CVE-2026-76504 gives unauthenticated attackers admin API access to all Cisco SD-WAN Manager deployments. No workaround. CISA deadline passed. Patch now.

FortiMail CVE-2026-104286 zero-day gives attackers unauthenticated file write on all supported branches. CISA deadline is October 4. Apply FG-IR-26-175 workaround now.

CVE-2026-48842 pre-auth SQL injection exploited in Roundcube Webmail virtuser_query plugin. Canadian Centre confirmed active attacks September 21. Update to 1.6.16 or 1.7.1 now.

CVE-2026-88771 gives unauthenticated attackers RCE on every default-config NetScaler. CISA deadline: September 30.

SharePoint CVE-2026-65660 code injection actively exploited: apply the Aug 11 patch before Monday's CISA KEV deadline.

Two CVSS 9.8 pre-auth flaws in Check Point Security Gateway and Management Server are actively exploited. CISA deadline: September 25.

CVE-2026-94127 in F5 BIG-IP APM enables unauthenticated RCE on OAuth servers. Federal agencies must patch by September 25.

CVE-2026-7273 in Zyxel GS1900 switches enabled a Chinese threat actor to compromise 996 devices across 48 countries. Patch firmware before September 24.

SAP OVERPASS CVE-2026-44756 (CVSS 10.0) gives unauthenticated attackers admin-level OS access on 10,000+ SAP systems. Patch Security Note 3747649 now.