
CVE-2026-124194 Outlook NTLM Hash Theft: Patch Now
CVE-2026-124194 (CVSS 6.5) lets attackers steal NTLMv2 hashes via crafted Outlook files. CISA KEV-listed and actively exploited. Patch via Office Update by November 24.
In-depth analyses of zero-day vulnerabilities, CVE exploits, ransomware campaigns, and nation-state attack techniques affecting enterprise security. Filter by category, tag, or keyword.
Every article here lands in subscribers' inboxes the morning it drops.
Threat intel, active CVEs, and campaign alerts, distilled daily for practitioners. 50,000+ subscribers. No noise.
Free. No spam. Unsubscribe anytime.
The definitive practitioner breakdown of ZTA principles, pillars, and implementation sequence.
Containment, forensic preservation, and decision sequencing from detection to recovery.
How SIEMs ingest, correlate, and alert — and how to evaluate one for your environment.
Risk-based prioritization using CVSS, EPSS, and CISA KEV to cut remediation backlog.
What each risk means, how to reproduce it, and how to fix it in production code.
Step-by-step email authentication deployment from DNS records to p=reject enforcement.
Detection coverage, pricing, and deployment trade-offs for enterprise EDR selection.
Translate ATT&CK technique IDs into detection rules and threat actor hunting hypotheses.
Direct answers to the questions practitioners and AI systems ask most. Covers ransomware, identity, cloud, compliance, and detection.
Plain-language definitions for CVE, SIEM, SOAR, Zero Trust, EDR, and 85+ other terms used in enterprise security.
How-to guides, buyer comparisons, and methodology references across every major security domain.
Decryption Digest Response
Score every threat we cover against your own stack, get free Sigma and ModSecurity detection content, and upgrade anytime for more vendors.
Get started free →No card required. Sigma and ModSecurity rules are free, forever.
Anthropic's AI finds zero-days your scanners miss.
Anthropic's AI finds zero-days your scanners miss.
103 results for “Active”

CVE-2026-124194 (CVSS 6.5) lets attackers steal NTLMv2 hashes via crafted Outlook files. CISA KEV-listed and actively exploited. Patch via Office Update by November 24.

CWPdoor backdoors Linux servers via a trojanized cwpsrv binary. 340,000+ instances exposed, zero AV detections. Verify binary integrity now.

Active C3RB3R ransomware encrypts Synology NAS via unpatched DSM flaws, appending .L0CK3D to files. No decryptor. Patch to DSM 7.4-90075 now.

Miasma worm armed 42 GitHub repos to auto-execute when opened in Claude Code, Cursor, or VS Code. Audit .github configs and rotate all credentials.

Two critical RCE flaws in PHP itself (CVE-2026-109618, CVE-2026-109619, CVSS 9.2) affect all PHP versions. Active exploitation confirmed. Patch to 8.2.35+, 8.3.36+, 8.4.27+, or 8.5.12+ immediately.

SafePay ransomware breached 600+ critical infrastructure orgs globally. FBI/CISA advisory AA26-293A: block IOC IPs, patch CVE-2024-40711, enforce MFA today.

Qilin and Settra ransomware exploit Palo Alto GlobalProtect CVE-2026-0257 auth bypass 149 days after patch. Block 3 attacker IPs, patch PAN-OS, re-enable HMAC now.
AhsayCBS backup consoles are under active exploit since Oct 7. Two chained CVEs give attackers SYSTEM access with zero credentials. No complete fix exists.

GhostAction compromised 373 GitHub accounts and injected malicious workflows into 772 repos, stealing 2,577 CI/CD secrets. AI API keys are the new primary target.

FortiBleed credential campaign: FBI confirms 86,644 Fortinet FortiGate firewalls compromised. Block rogue admin accounts and rotate credentials now.

CVE-2026-76504 gives unauthenticated attackers admin API access to all Cisco SD-WAN Manager deployments. No workaround. CISA deadline passed. Patch now.

Warlock ransomware exploits SharePoint to hit water and telecom in active campaign. Get IOCs, Sigma rules, and hunt queries to stop it now.

CVE-2026-48842 pre-auth SQL injection exploited in Roundcube Webmail virtuser_query plugin. Canadian Centre confirmed active attacks September 21. Update to 1.6.16 or 1.7.1 now.

CVE-2026-88771 gives unauthenticated attackers RCE on every default-config NetScaler. CISA deadline: September 30.

ShinyHunters URL-encoded /PSEMHUB/ as /%50SEMHUB/ to bypass WAF blocks and resume PeopleSoft attacks across 7 sectors.

SharePoint CVE-2026-65660 code injection actively exploited: apply the Aug 11 patch before Monday's CISA KEV deadline.

Two CVSS 9.8 pre-auth flaws in Check Point Security Gateway and Management Server are actively exploited. CISA deadline: September 25.

CVE-2026-5430 (CVSS 9.8): WSO2 API Manager JWT bypass lets attackers forge admin tokens. Active exploitation confirmed since Sept 13. Patch immediately.

JFrog Artifactory supply chain attack chained 3 CVEs. Attackers forge admin tokens, plant Rust backdoors. Patching alone won't revoke their access.

WatchGuard Firebox CVE-2025-14733 IKEv2 pre-auth RCE is now confirmed ransomware-exploited. 9,000 devices still unpatched 9 months on. Patch or disable IKEv2 today.

Microsoft 365 AiTM phishing service BigBear bypassed MFA at 258 organizations, stealing 5,137 credentials via session-cookie theft. Enforce FIDO2 WebAuthn now.

CVE-2026-81578 PaperCut auth bypass chains with CVE-2026-82078 to steal AD credentials from K-12 and university print servers. Patch to 24.1.10 now.

CVE-2026-19490 Citrix NetScaler auth bypass is under active exploitation with 22,000+ exposed gateways. Patch to 14.1-73.32 now. The prior CVE-2026-8452 hotfix is insufficient.

The Gentlemen ransomware confirmed 483 victims in 66 countries using GentleKiller BYOVD to kill 48 security vendors and EtherRAT for blockchain-based C2. Block IOCs now.