ARTICLES COVERED:

1. ENISA scales up its role in the CVE Program | ENISA (European Union Agency for Cybersecurity (ENISA))

ARTICLES COVERED:

1. QuickFox Supply Chain Attack Used to Deploy FDMTP Implant (Fortinet)

ARTICLES COVERED:

1. omp-re: Reverse-engineering suite for omp: radare2 tools, evidence store, signed audit log, RE status band, and report generator. (lancejames221b)

ARTICLES COVERED:

1. OctLurk and SilkLurk: new Backdoors in Central Asia (Kaspersky)
2. Alert to Countries, Companies, and Other Entities Regarding North Korean IT Workers (U.S. Department of State)
3. Scanning 7.6 Petabytes of HuggingFace Training Data for Secrets - 221,000+ live creds (Truffle Security Co.)
4. ENISA Secure by Design and Default Playbook | ENISA (ENISA (European Union Agency for Cybersecurity))
5. Understanding Implicit Trust Errors in Core Carrier Networks through Multi-Agent Flaw Discovery and Analysis (Nanyang Technological University)
6. Rusty Bootkit - Windows UEFI Bootkit in Rust (Codename: RedLotus) (memN0ps)
7. binja-diff: Binary Ninja diffing tool (matteyeux)

ARTICLES COVERED:

1. Implications of Recent CISA Disclosures on Iranian OT Targeting (Dataminr)
2. A new ETSI standard could rewrite the memory-safety debate (CHERI Alliance)
3. ADR: ADR secures enterprise AI agents through observability, security benchmarking, and threat detection. Deployed at Uber. (Uber)
4. Apple Screen Sharing Pre-Auth RCE (macOS ≤ 26.5) (bl4sty)

ARTICLES COVERED:

1. Tracing SNOWLIGHT: A China-Nexus Campaign Against Government Infrastructure (SOCRadar® Cyber Intelligence Inc.)
2. CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft | Microsoft Security Blog (Microsoft)
3. Uncovering the Fuyao Enterprise: A Shift in Modern Ad-Fraud (Bitsight)
4. Technical Deep Dive into the Entropy Issue - in Coldcard bitcoin hardware wallet (Coinkite)
5. Tailscale in the Hugging Face intrusion: The good news and the bad news (Tailscale)
6. Anthropic's Fever Dream: Claude's package anthropickit that stole real keys (Aikido Security)
7. IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains (Cisco Talos)
8. screenlogger: Private, searchable screen history for macOS. (radkawar)
9. Inside the Falcon How CrowdStrike Catches You (0xDbgman)
10. A New SiliVaccine: North Korea’s Antivirus (Martyn Williams)

ARTICLES COVERED:

1. CosmosEscape: Taking Over Every Azure Cosmos DB (Wiz)
2. Stronger with every update: How we’re making Chrome and the web safer in the AI Era (Google)

ARTICLES COVERED:

1. Amazon identifies North Korean hacker group behind open-source supply chain attacks (Amazon Web Services)
2. @copilot-mcp/apex: A macOS Infostealer Re-Published on npm After Takedown (Safedep)
3. Two Joyfill npm Beta Releases Compromised to Deliver DEV#POP... (Socket)
4. PolinRider Caused Dozens of npm, Go, PHP Compromises (OpenSourceMalware)
5. Adform compromised to serve crypto stealer via supply chain attack (Kevin Beaumont)
6. Mitigation Guidance for Supply Chain Compromise | Google Cloud Blog (Google)
7. 2026 Minimum Elements for a Software Bill of Materials (SBOM) (Cybersecurity and Infrastructure Security Agency (CISA))
8. -[Joint Cyber ​​Security Advisory] Operation Double Barrel (The Relationship Between State-Backed Hacking Organizations and the Gunra Ransomware Group) (AhnLab)
9. Operation Double Barrel (AhnLab Security Intelligence Center (ASEC))
10. Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks (Palo Alto Networks)
11. ClickFix, EtherHiding & a DPRK Wallet Trail (AllSecure Corp)
12. The 73,000-server market reselling Western frontier AI into China - Infrawatch (InfraWatch)
13. Investigating three real-world incidents in our cybersecurity evaluations (Anthropic)
14. Credential Stuffing Campaign Hits SonicWall (Huntress)
15. Malicious Cyber Actors Targeting Water and Wastewater Sector Internet- Facing Programmable Logic Controllers, Causing Operational Disruptions | Federal Bureau of Investigation (Federal Bureau of Investigation)
16. Welcome to Danglegeddon (Silent Push Inc.)

ARTICLES COVERED:

1. Cleaning Out Inboxes: TA488 Comes for Outlook with Another Half-Click Exploit | Proofpoint US (Proofpoint)
2. Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident (Hugging Face)
3. SakDriver: Reversing a Windows Kernel Driver Rootkit (oxfemale)
4. power-pages-security-utils: power pages security utils to analyse and audit power page apps / sites (DfE Digital)

ARTICLES COVERED:

1. "HermeticReader" , The Vulnerability That Turned Adobe's 300M-Install Extension Into a Full WhatsApp Takeover (Guardio)

ARTICLES COVERED:

1. Really Muddy Waters — Refuting the Seedworm Attribution of Commodity MaaS (digicat)
2. Dear Diary, Today I found a Ghost in the Network (Intrusion Truth)
3. Puppeteers: Chinese hackers still trick Claude into dirty work. (NetAskari)
4. Project-Orbital: Operational Relay Box Intelligence, Tracking, & Analysis Lexicon (ORBITAL) (BushidoUK)
5. Inside the growing residential proxy botnet threat (Lumen Technologies)
6. Random Windows Things Part 2: Unexpected Clipboard Data Behaviour (Winsider Seminars & Solutions Inc.)
7. An Automated Framework for Extracting Reachable Attack Chains from Cyber Threat Intelligence Report (Cornell University)
8. Technical Details: Const Evaluation and Data Layout - Rust on CHERI (CHERIoT Platform)
9. The SID that wasn’t there: bypassing KB5014754 to Domain Admin on a fully patched AD CS (Mohamed Alzhrani)

ARTICLES COVERED:

1. APT42: AI-Assisted Rapport Phishing and a More Resilient TAMECAT (Darkatlas Squad)
2. DNS Poisoning Tactics Expand to Hospitality Wi-Fi (ReliaQuest)
3. Russian Global Webmail Espionage (Palo Alto Networks)
4. Windows Persistence Forensics: Services, Scheduled Tasks, and Autoruns (Seth Enoka)
5. Hunt for Certighost (CVE-2026-54121) exploitation (f-bader)
6. KernelCallbackTable Process Injection (S12)
7. beignet: MacOS Shared Library to Shellcode Loader (sliverarmory)
8. What Does Windows HyperGuard (SKPG) Protect in ntoskrnl? (0xflux)
9. Reconstructing cloud identity intrusions from O365 and CloudTrail logs (Doby Baxter)
10. NaX: Custom Adaptix-compatible C2 agent - PIC beacon + Stardust UDRL + Go extender plugins (Maor Sabag)
11. Virtualization Internals Part 5 - KVM Internals: From VM Creation to Guest Execution (Ayoub Faouzi)
12. SliverC2-Evasion-Suite: Four-kit defense evasion suite for Sliver C2: Crystal Palace loader, sleep masking, in-memory PE execution, and remote process injection with PPID spoofing. (panwnvda)

ARTICLES COVERED:

1. CheckPoint Security Advisory - Action Required - July 2026 Security Update - , we identified one of those in the wild, affecting a handful of customers. (Check Point Software Technologies)
2. Cl0p Exploitation of PTC Windchill & FlexPLM (CVE-2026-12569) (Ransom-ISAC)
3. Its AI agent spent days hacking a company, but sources say OpenAI did not notice for a week (Reuters)
4. Patchmageddon (J.P. Morgan Asset Management)
5. Inside a DPRK BlueNoroff ClickFix Kit (JUMPSEC)
6. Updated Cyber Threat Actor Naming System | Google Cloud Blog (Google)
7. AgentBaiting: How Fake AI Skills Deliver Malware at Scale (Island)
8. SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor - StepSecurity (StepSecurity)
9. @copilot-mcp/apex: A macOS Infostealer Re-Published on npm After Takedown (SafeDep)
10. The Week of Sandbox Escapes (Pillar Security)
11. Silent Replacement of Trusted macOS App Executables (Talal Haj Bakry and Tommy Mysk)
12. SiemQueryBuilder: This repository is for the Threat Intelligence Analyst and The Threat Hunter for performing IOC sweeping on multiple SIEM Platform. (Hashir14k)
13. data-diode: A Data Diode with 2 Raspberry Pi and OpenBSD (Sven Seeberg)
14. Cisco's Transition to a Risk-Based Vulnerability Disclosure Model (Cisco)
15. Next chapter: Restructuring GitHub's bug bounty program (GitHub)
16. raptor-loop-hunt: RAPTOR autonomous looping multi-altitude security vulnerability hunt — Claude Code skill (dinosn)
17. An Automated Framework for Extracting Reachable Attack Chains from Cyber Threat Intelligence Reports (Cornell University)
18. Small, Free, and Effective: Orchestrating Open-Weight Small Language Models to Outperform Single LLM for Malware Analysis (Adel ElZemity, Shujun Li, and Budi Arief)
19. The-Jinn-Guard: Kernel-aware agent governance daemon. Tamper-evident hash-chained audit ledger, BPF-LSM enforcement, Z3-backed policy checks. Research prototype. (AlphaReasoning)

ARTICLES COVERED:

1. Analysis of the Latest Tactical and Technical Upgrades of the APT-C-00 (Ocean Lotus) Organization (腾讯 (Tencent))
2. Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged (Hunt.io and Bob Diachenko)
3. Look What You Made Us Patch: 2025 Zero-Days in Review (Google)
4. Security Vulnerability Patterns in AI-Generated Code: A Cross-Model Comparative Study (Shanna M. Kahn and John D. Hastings)
5. Dark Elevator: Windows Install Service Local Privilege Escalation (CVE-2026-50343) (blog.calif.io)
6. STAR: Semantic-Traffic Alignment and Retrieval for Zero-Shot HTTPS Website Fingerprinting (Institute of Information Engineering, Chinese Academy of Sciences; School of Cyber Security, University of Chinese Academy of Sciences; Institute for Network Sciences and Cyberspace, Tsinghua University)
7. Bind Link Abuse: One Windows Feature, Many Ways to Blind Your EDR (Bitdefender)
8. BlinkLinkSentiennel: A user-mode detection sensor prototype for bind-link abuse on Windows, the EDR-evasion class documented by Bitdefender (Alloy Secure Group)
9. Using WebDav to Outsmart Smartscreen, MOTW, and that OTHER Alert (R.B.C (g3tsyst3m))
10. CVE-2026-54121: Certighost POC (aniqfakhrul)
11. Shellph: Shellph is a portable command-line utility designed to automate encryption and obfuscation of arbitrary shellcode. Named after my cat (Belph) (xirtam2669)
12. Mohabi: Disaggregating and Sandboxing the Firefox JavaScript Engine (USENIX Association)
13. Procurement guidelines for the cybersecurity of hospitals and healthcare providers (European Union Agency for Cybersecurity (ENISA))
14. Security Guidelines for Storage Infrastructure: Draft SP 800-209r1 Available for Public Comment (National Institute of Standards and Technology)
15. open-connector: Open-source auth gateway connecting 1000+ SaaS providers to AI agents through SDK, CLI, MCP, HTTP, and OpenAPI. (OOMOL Lab)
16. We argue that the bottleneck in LLM vulnerability discovery is not model capability, but codebase decomposition. Along the research, we've discovered .diff are more interesting than we've presumed. (Pwno.io Inc.)
17. Sol Searching | Can Frontier Models Tackle Autonomous Long-Horizon Malware Analysis? (SentinelOne)
18. llm-observer-proxy-go: Run-scoped LLM observation proxy with an embedded Bifrost data plane (xxyyue)
19. Pixels to Payload: Dissecting a Four-Stage Bitmap-Steganography Dropper Delivering AsyncRAT (Rhys Downing)
20. Remus-Stealer-Fileless-Payload-Extraction-C2-Exfiltration-Analysis: "Reverse engineering analysis of Remus Stealer, uses fileless execution, clipboard theft, screen capture, and C2 communication. (kaandemir993)
21. Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel (Cisco Talos)
22. GCSA洞察：Fastjson 1.2.83 “Gadget-Free” 漏洞（0day）深度分析与防御指南 - In-depth Analysis and Defense Guide for the Fastjson 1.2.83 “Gadget-Free” Vulnerability (0day) (The information regarding the organization or individual that controls the content at the provided URL could not be retrieved.)

ARTICLES COVERED:

1. Operation RoundPress Rolls on with More Half-Click Webmail Zero-Days from TA458 (Proofpoint)
2. JadeProx: Tracing a China-nexus Operation Through an OPSEC Mistake (Group-IB)
3. Analysis of Kimsuky's Attack on a South Korean Groupware Vendor Using a New Gomir Family Variant (ENKI)
4. TAG-195 Upgrades MaaS Ecosystem with Modular Tools (Recorded Future)
5. New BitLocker extortion activity: RDP, MSSQL, RMM Abuse (AO Kaspersky Lab)
6. Large-Scale GitHub Actions Abuse Powers a Distributed cPanel... (Socket)
7. Oracle Critical Patch Update Advisory - July 2026 - "This Critical Patch Update contains 1449 new security patches across the product families" (Oracle Corporation)
8. Releases now reject new files after 14 days - The Python Package Index Blog (Python Software Foundation)
9. U.S. GAO - Cybersecurity Regulations: Multiple Sectors Are Subject to Potentially Duplicative Reporting Requirements (U.S. Government Accountability Office)
10. UK and partners expose Russian state-supported actors for new ‘zero-click’ phishing campaign targeting Western organisations (National Cyber Security Centre (NCSC))

ARTICLES COVERED:

1. Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure (Cybersecurity and Infrastructure Security Agency)

ARTICLES COVERED:

1. MuddyWater: ClickFix to Telegram & PatchAgent Backdoor (Ransom-ISAC)
2. [QuickNote] SolidPDFCreator – Mustang Panda Stage-1 Backdoor (Target India) (kienmanowar)
3. [QuickNote] Mustang Panda ToneShell (APT S1239) Beacon Shellcode – RE Analysis (Kienmanowar)
4. Inside Pegasus: The evolution of the world's most notorious spyware system - Amnesty International Security Lab (Amnesty International's Security Lab)
5. OpenAI and Hugging Face partner to address security incident during model evaluation (OpenAI)
6. Exploit brokers pay $500,000 for a WordPress RCE. I found one with GPT5.6 Sol Ultra and $25 (Searchlight Cyber)
7. CVE-2026-50502 : RCE via le service Windows Event Log (Login Sécurité)
8. Open Directory Stages NGINX Rift and Ghost CMS Exploits Against Government and Finance Across Eleven Countries (Hunt Intelligence, Inc.)
9. Introducing Antares: Highly Efficient Open Weight AI Models for Vulnerability Localization (Cisco)
10. Grand Idea Studio: Reverse Engineering a Ledger Nano X Hardware Implant (Grand Idea Studio)
11. Furtex: Post-exploitation and evasion research toolkit for Linux. (MatheuZSecurity)
12. DPRK’s Famous Chollima Deploys RATs Through ClickFake Job Interviews (SOCRadar® Cyber Intelligence Inc.)
13. ChainVeil and ViteVenom are DPRK’s PolinRider Campaign (OpenSourceMalware)
14. Chinese police repatriate key suspect in phishing and Trojan virus case from Vietnam (China Daily)
15. Unpacking “Cruciferra”: An Analysis of a Sophisticated Crypter Service | Proofpoint US (Proofpoint)

ARTICLES COVERED:

1. The Morris Worm: The Internet's First Major Wake-Up Call (Historical Archive)

ARTICLES COVERED:

1. Contagious Interview malware in SVG images: DPRK campaign (Elastic)
2. The One Chokepoint to Rule Them All: Why I Deleted 50 ClickFix Detection Rules and Replaced Them with One (Ddosier)
3. grokpatrol: Open-source, offline forensic scanner CLI tool designed to detect evidence of git repo collection or upload by the Grok Build CLI to xAI infrastructure. (Optimus Labs)
4. Half a Second - The Backdoor That Almost Broke the Internet, and the Invisible Labor Beneath It (Adrian Mastronardi)
5. OpenSSL HollowByte: A DoS Hiding in 11 Bytes (Okta)
6. Accessing sensitive Passwords app account data on macOS (CVE-2025-24169) (Josh Parnham)
7. IPhone Hacking Firm Sues Ex-Worker Over Alleged Theft of Secrets (Bloomberg)
8. Magnet Forensics, LLC v. Del Gaudio (1:26-cv-03781) - allegedly Magnet were exploiting usbliter8 BootROM exploit that Paradigm Shift published - said it was leaked (Free Law Project)
9. Benchmarking 13 AI Models on Known CVE Detection (Aikido Security)

ARTICLES COVERED:

1. The RedLine Thread That Led to a Maritime BEC Infrastructure Cluster (VMRay)
2. Iran Reportedly Used a 1970s Phone Protocol to Track U.S. Troops Before Missile Strikes (Yahoo)
3. 금융보안원 - This report provides an in-depth analysis of attack and money laundering techniques employed by state-backed hacking organizations regarding cross-chain security threats among digital assets (금융보안원)
4. PolinRider Confirmed Footprint Grows 6.5x Since March (OpenSourceMalware)
5. European Password Manager Shares Origins and Updates with State-Certified Russian Firm (Organized Crime and Corruption Reporting Project (OCCRP))
6. Save the Date for Spamouflage (Graphika)
7. HelloNet campaign: a threat via the ViPNet update system (AO Kaspersky Lab)
8. ZSB-26014: Zoom Workplace for Windows - Improper Input Validation (Zoom Video Communications, Inc.)
9. Windows AppResolver LPE: From AppContainer to SYSTEM (David Carliez)
10. How I found an integer overflow in tcpip.sys (aprilpet)
11. wp2shell: Pre Authentication RCE in WordPress Core (Searchlight Cyber)
12. wp2shell - Code Trace Deep Dive (ZephrFish (Andy Gill))
13. wp2shell-poc: wp2shell - Independent proof-of-concept for the unauthenticated WordPress REST batch route-confusion SQL injection associated with Searchlight Cyber's wp2shell advisory. (Icex0)
14. Bit2Watt: A Cyber-Physical Vulnerability Exploiting GPU Workloads Across Power and Computing Infrastructures (Zhouhao Ji, Kaikai Pan, and Wenyuan Xu)
15. CVE-2026-49488: Apache OpenMeetings: Arbitrary File Read (Openwall)
16. lCVE-2026-50416-writeup-and-poc: CVE-2026-50416: Windows 11 KASLR bypass (karollol)
17. Proxying to Compromise: SonicWall Secure Mobile Access 0-day Exploitation (Volexity)
18. Report into preliminary inquiries of Qantas (Office of the Australian Information Commissioner)
19. SingGuard-NSFA: Extensible Guardrails for Agentic AI via Generative Reasoning and Real-Time Classification (SingGuard Team, AI Security Lab, Ant Group)
20. tarit: A hypervisor and sandbox cloud for self-hosted AI agents and RL (Instavm)
21. Incantation: AI Deception Layer for - containing adversarial context designed to redirect or confuse an LLM agent reading your own infrastructure (Casey)
22. Crossing the Golden Gate: macOS's New Application Support Protection (Wojciech Reguła)
23. White House Launches Gold Eagle Initiative for Unprecedented Cybersecurity Vulnerability Coordination (The White House)
24. AD-PathFinder: Attack path mapping for Active Directory, ADCS, SCCM, and MSSQL using BloodHound CE + OpenGraph data. (NetSPI)
25. Offensive-COM: Research notes on Windows Component Object Model (COM) attack surface for offensive security and vulnerability research. (An0nUD4Y)
26. DinDoor, DenoRAT, and NightshadeC2: Analyzing TAG-150's Evolving Tradecraft (eSentire)
27. JSAC2027 - January, Tokyo - CFP (JPCERT/CC)
28. The State of Ransomware 2026 - Stolen identities cause 79% of ransomware attacks (Sophos Ltd.)
29. clx: A cross-platform ahead-of-time Lua compiler and runtime, using C++20 backend (Tine Samir)

ARTICLES COVERED:

1. How NHS England improved sign-in times and saved over £1m with passkeys (Google LLC)
2. Security incident disclosure — July 2026 - "The intrusion started where AI platforms are uniquely exposed: the data-processing pipeline." (Hugging Face)

ARTICLES COVERED:

1. Operation Capsule Vault: RokRAT Attack Chain Analysis Using EMBED_PAYLOAD_v2 (Genians)
2. Daxin Returns: Stealthy Malware Resurfaces in Taiwan Alongside a New Backdoor (Broadcom)
3. Co-Founder of Controversial Spyware Firm Had Israeli Diplomatic Passport (Organized Crime and Corruption Reporting Project (OCCRP))
4. Moroccan intelligence insider reveals widespread use of Pegasus hacking software (The Guardian)
5. Detections for LegacyHive exploitation by GossiTheDog (GossiTheDog)
6. Revised Telecommunications Security Code of Practice 2026 (version 1.1) (Department for Science, Innovation and Technology)
7. Establishing a Coordinated Vulnerability Disclosure Program to Work With Security Researchers (media.defense.gov)
8. AsyncAPI Supply Chain Compromise via GitHub Actions (Wiz)
9. Teen hackers jailed after live streaming cyber attack on TfL - sentenced to five years and six months in prison. (BBC)
10. COM Hijack for CLSID {9FC8E510-A27C-4B3B-B9A3-BF65F00256A8} (Astharot15)
11. CET-Compliant Callstack Spoofing via Thread Pool Enum Callback Trampolining (Tiziano Marra)
12. Registry Snapshots for Post Exploitation Enumeration (S12 - 0x12Dark Development)
13. UnwindRaven is a Windows x64 offensive research framework that constructs fully synthetic call stacks at thread startup time, making a newly created thread appear (toneillcodes)
14. There and Back Again: An Operators Guide on NTLM Relaying Egress (SpecterOps)
15. windows-process-injection: A collection of techniques for process injection on Windows (toneillcodes)
16. Ghost in the 7‑Zip: The Shadow of Residential Proxies Creeping into Your Life (DOCOMO BUSINESS, Inc.)
17. BingusLdr: BingusLdr is a DLL loader built with Crystal Palace that uses a CET compatible stack spoofing technique. (Sizeable-Bingus)
18. Modular PIC Implant Design (Kirchware)

ARTICLES COVERED:

1. REWARD UP TO $10,000,000 USD - FOR INFORMATION ON Russian Malicious Cyber Actors (U.S. Department of State)
2. Alleged Russian cyber spy in Boston case previously worked for Kaspersky, source says and documents show (Thomson Reuters)
3. BirdCall: ScarCruft Malware Masquerading as Zangi Messenger (S2W)
4. Analysis of attack actions suspected to be from the APT-C-26 (Lazarus) group upgrading its monitoring program (奇安信威胁情报中心)
5. Suspected Chinese Operators Use Claude Code and DeepSeek to Breach Government Systems Across Four Countries (Hunt.io)
6. Introducing CylindricalCanine: The GoldenEyeDog subgroup responsible for the April DigiCert incident (Expel, Inc.)
7. DoNot (APT-C-35) Intrusion Targeting Bangladesh Military Personnel (Cyderes)
8. TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains (Elastic)
9. Tailscale: Tailscale SSH previously accepted usernames that contained a leading - character. On Linux platforms these usernames were passed as arguments to getent(1) leading to ACL bypass (Tailscale Inc.)
10. cyber-decoy: Experimental Decoy Broker (secdev02)

ARTICLES COVERED:

1. Three Russian Nationals Indicted for International Cybercrimes Resulting in More Than $62M in Losses to Victims (U.S. Attorney's Office for the Northern District of Ohio)
2. Suspected Chinese Operators Use Claude Code and DeepSeek to Breach Government Systems Across Four Countries (Hunt Intelligence, Inc.)
3. Update on Attacks by Threat Group APT-C-60 in 2026 (JPCERT/CC)
4. CERT-UA Handled 3,309 Cyber Incidents in the First Half of 2026 (State Service of Special Communications and Information Protection of Ukraine)
5. Malicious GitHub Campaign: Fake "Arctic Wolf" and 290+ Brand-Impersonation Repositories Deliver BoryptGrab-Lineage Infostealer (Arctic Wolf)
6. Threat Intelligence Report: The Pro-Iran Hacktivist Ecosystem 2026 (DomainTools)
7. Public to be told how to prepare for cyber-attack and weather emergencies (British Broadcasting Corporation)
8. Forgotten UEFI shims undermining Secure Boot (ESET)
9. LegacyHive : Windows user profile service arbitrary hive load elevation of privileges vulnerability (MSNightmare)
10. SonicWall PSIRT has investigated multiple cases indicating the active exploitation of the vulnerabilities described in this advisory. Customers are strongly urged to upgrade (SonicWall)
11. Miasma Worm Returns to npm (JFrog)
12. Lucide Proxy: Turning Student Web Proxies into DDoS Bots (JFrog)
13. OAuth Client ID Spoofing: Why Fake Client IDs Are Gaining Traction for Stealthy Enumeration (Proofpoint)
14. Burnt by Burgers: Highlighting Void Blizzard’s Russian State Links (Hunt.io)
15. Pandora’s Container Part 1: Unpacking Azure Container Security (TrustedSec)

ARTICLES COVERED:

1. Targeting and Compromise of French Entities Using the Turla Intrusion Set (Agence nationale de la sécurité des systèmes d'information (ANSSI))
2. UK and Allies urge critical sectors to improve defences against Russian intelligence targeting (National Cyber Security Centre (NCSC))
3. Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting (Cybersecurity and Infrastructure Security Agency)
4. Russian man pleads not guilty in US cyber espionage case (AOL Media LLC)
5. UK and EU strike Russian cyber networks with new sanctions (Foreign, Commonwealth & Development Office)
6. Hidden Exfiltration Capability Discovered in a Trusted, 900,000-User Chrome Web store Extension (Stripe OLT)
7. jscrambler npm Package Compromised in Supply Chain Attack (Socket)
8. SharpViewStateKing: The stealthy implant framework - Canadian Centre for Cyber Security (Canadian Centre for Cyber Security)
9. chimera: Sandbox untrusted code with safe access to the host. (Pekka Enberg)
10. Lessons from CISA’s Cyber Incident (Cybersecurity and Infrastructure Security Agency (CISA))

ARTICLES COVERED:

1. One Misconfigured Server, Three Active Campaigns: Full exposure of three AiTM Phishing Operators (Ambionics)
2. How WP-SHELLSTORM Exposed 1.4M WordPress Sites (SOCRadar® Cyber Intelligence Inc.)
3. How a Gang of Thieves Pulled Off a Multimillion-Dollar Data Center Heist (The New York Times)
4. Teen accused of using ChatGPT to delete 46,000 anime accounts (The Asahi Shimbun Company)
5. Unfit to Boot: Breaking U-Boot's FIT Signature Verification (Binarly)
6. Patch Release Update: Zimbra 10.1.19 - 'security issue in the Classic Web Client where a specially crafted email could run malicious code when the email is opened' (Synacor)
7. The SQL Server Unicode problem: why your data might not be what you (Synacktiv)
8. Man Serving Federal Prison Sentence Charged with Theft of Forfeited Cryptocurrency (United States Department of Justice)
9. AnyDesk forensic artefacts (Ayush Anand)
10. Use Unified Sign-In logs in Advanced Hunting (Fabian Bader)
11. Finding SOCKS with Proxywatch (SpecterOps)
12. stinger: Unprivileged endpoint deception for macOS and Linux workstations. Uses FIFO baits, other local traps, and protected sessions to detect secret collection as it happens. (0x4D31)
13. EPM Part 3: Writing Intune Endpoint Privilege Management rules for the real world: File hash, certificate, and when each one is the wrong choice - MSEndpointMgr (MSEndpointMgr)
14. Scheme Hunter - Enumerate URI schemes and prototype invocation - WDAC / AppLocker Bypass Recon Scripts (AlloySecureGroup)
15. Kestrel: Passive Active Directory security enumeration via native ADSI/COM interfaces. (ssteelfactor-oss)
16. tempolocus: Tempolocus is a time-series activity patterns and approximate location inference (CIRCL)
17. How Windows App Execution Aliases Work (and How to Read Them in C++) (Pavel Yosifovich)
18. JQ for Hackers (TrustedSec)
19. CaddySmith: Generate Caddy redirector configs from Cobalt Strike or Sliver C2 profiles. (IceCubeSandwich)

ARTICLES COVERED:

1. Tracking a K8-Branded Web Cluster Across 10,156 Domains (Webamon)
2. GodDamn Ransomware: Latest Beast Rebrand Uses Malicious Driver to Disable Defenses (Broadcom)
3. Dell BIOS Passwords: Weak XOR Encryption Allows Recovery from SPI Flash (CVE-2026-40639) (AmberWolf)
4. RedWing: A Mobile Malware-as-a-Service Operation (Zimperium)
5. nodemon-sudo: an npm Backdoor With No Install Script (SafeDep)
6. Adversarial Intelligence: Local LLMs for Automated Attacks (Mike Scutt)
7. klist.exe Revisited: Internals and Further Use Cases (Jake Otte)
8. nimcrypt: Nim-based encryption tool for obfuscating shellcode and payloads for evading Windows Defender. (Chaelsoo)
9. klist2ccache: Dump TGTs remotely and convert Windows' klist binary output to ccache. (jakeotte)
10. ida_rpc: IDA Pro RPC for assisted RE-tasks (B.Kerler)
11. Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? (arXiv)
12. Sighthound: rule-based SAST scanner (Corgea)

ARTICLES COVERED:

1. DarkSpectre — a Chinese state-sponsored threat actor, maintains persistent access to enterprise environments by weaponizing legitimate browser extensions after establishing a trusted user (ExtraHop)
2. Large-scale exploitation campaign targeting website content management systems (CMS) (Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC))
3. Nederland doelwit van Russische spionageoperatie via IP-camera’s | The Netherlands targeted by Russian espionage operation via IP cameras (Rijksoverheid)

ARTICLES COVERED:

1. One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law Enforcement (SentinelOne)
2. Malicious Go Module Exposes GitHub Malware Lure Network Spanning 222 Repositories (Socket)
3. Onderzoek naar hack Odido wijst op mogelijke betrokkenheid Nederlanders | Investigation into Odido hack points to possible involvement of the Dutch (Politie Nederland)
4. Not-so-anonymous telemetry: The @injectivelabs/sdk-ts backdoor (Datadog)
5. Cybersecurity Startup Publishes Infostealers to NPM (Paul McCarty)
6. Januscape: Guest-to-Host Escape in KVM/x86 (Hyunwoo Kim)
7. XRING: Crashing XQUIC with spec-compliant QPACK instructions (FoxIO)
8. Vulnerabilities of Realtek SD card reader driver, part2 (zwclose)
9. CitrixBleed 2 (CVE-2025-5777) 7Steps to Dragonforce Ransomware (Huntress)
10. Coordinated npm and PyPI Campaign Typosquats Popular Secure Payment Apps (Socket)
11. Beware of Agentic Botnets: Scalable Untargeted Promptware Attacks via Universal and Transferable Adversarial HalluSquatting (Aya Spira, Stav Cohen, Elad Feldman, Ron Bitton, Avishai Wool, and Ben Nassi)
12. GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware (Microsoft)
13. Random Windows Things Part 1: PreviousMode Mitigation (Winsider Seminars & Solutions Inc.)
14. Evolving Windows vulnerability management to meet the speed of AI-powered discovery (Microsoft)

ARTICLES COVERED:

1. AI Research in Security Operations Pushing the frontier of AI agents for real security work (Cotool)
2. Inside an AI-Assisted Cloud Attack: Familiar Techniques at Unfamiliar Speed - or written another way AI slower than most ransomware crews (Sygnia)
3. Process Parameter Poisoning (Orange Cyberdefense)
4. GitLost: How We Tricked GitHub’s AI Agent into Leaking Private Repos (Noma Labs)

ARTICLES COVERED:

1. The Investigation Bureau has cracked a case involving the Chinese Communist Party's cyber army, which impersonated international journalists to conduct social engineering attacks (Ministry of Justice Investigation Bureau)
2. Cavern Manticore: Exposing Iran-Linked Modular C2 Framework (Check Point Research)
3. The National Police have arrested a suspected collaborator of the pro-Russian hacktivist groups CyberArmy of Russia Reborn (CARR) and Z-Pentest. (Dirección General de la Policía)
4. UAT-7810 continues building ORB networks using new malware (Cisco Systems, Inc.)
5. One Email Closer to the Edge: UNK_MassTraction & the Physics of Exploitation (Proofpoint)
6. PhantomFS: PhantomFS is a Windows honeypot that projects convincing decoy files — credentials, financials, SSH keys — into a virtual directory via ProjFS, then fires instant Event Log (Alloy Secure)
7. Windows Privilege Abuse: Attackers' Path to Active Directory Compromise (Semperis)
8. Recovering Active ADFS Signing Keys via Machine DPAPI | Google Cloud Blog (Google)
9. Full writeup of the Windows GDID - Global Device Identifier fully reverse engineered (SmtimesIWndr)
10. GDID Disabler - Windows (SmtimesIWndr)

ARTICLES COVERED:

1. Hook Chains (how I built Crystal Kit incorrectly*) (Rasta Mouse)
2. EasyTokens: Kali365 - EvilTokens Replica (Casey Smith)

ARTICLES COVERED:

1. TONResolver RAT Abuses TON Blockchain to Target Japan's Hotel Industry (Trend Micro)
2. Does anyone even use GitHub for federated authentication? (Sapir)
3. Multiple Local Privilege Escalation Vulnerabilities in Little Orbit GFAC Driver (GFAC_Sys_x64.sys) (FzRsLLaSheR)
4. Identity Crisis in Confidential Computing: Formal Analysis of Attested TLS (Association for Computing Machinery (ACM))
5. Improved RpcGhosting (Practical Security Analytics)
6. Escalating from On-prem to Entra through MITM Attacks (SVA System Vertrieb Alexander GmbH)
7. Exploring cross-domain & cross-forest RBCD: part 2 (Synacktiv)
8. @marketfront: 25 npm Packages Reuse a Known Lure (Safedep)
9. Linux Backdoor Targeting iKuai Routers (dmpdump)
10. NebulaPulsar: NebulaPulsar is a proof-of-concept in-memory implant framework for Java (JSP) and ASP.NET (ASPX/ASHX/ASMX) webshells, originally developed as part of the Alien project. (iss4cf0ng)
11. GeoLocation_BOF: Cobalt Strike BOF to obtain location data (CodeXTF2)
12. Hunting Sleeping Giants: Detecting Encrypted Beacon Sleep Obfuscation (Russell Allen)
13. BareMetal-RAM-Dumper: A bare-metal x86 utility to dump physical RAM directly to disk. Built and tested for Cold Boot Attack experiments on frozen memory. (pIat0n)
14. Nox: Modular Go framework for attack surface management, reconnaissance, and vulnerability scanning. (kernelstub)
15. T3MP3ST: autonomous red teaming platform; multi-agent offensive-security meta-harness (elder-plinius)
16. Arrest of Iranian Hacker Spotlights Iran’s Movement into Economic Espionage and IP Theft (Kim Zetter)
17. Inside Kimsuky’s CHM Tradecraft: Multi-Stage Execution and Selective Payload Delivery (Synaptic Systems)

ARTICLES COVERED:

1. Exploitation of CitrixBleed 2 (CVE-2025-5777) Began Before PoC Was Public (GreyNoise, Inc.)
2. The Gentlemen RaaS: rapid growth and a new ransomware variant (AO Kaspersky Lab)
3. How I broke Rhysida ransomware encryption (Sigreturn Labs)
4. From CitrixBleed 2 to Cloudflared: The Tools and Techniques Behind Anubis Ransomware Attacks (Arctic Wolf)
5. Armored Likho's new weapon: BusySnake Stealer - "tied to a previously unknown APT group that we dubbed Armored Likho (also known as Eagle Werewolf based on circumstantial evidence)." (AO Kaspersky Lab)
6. GRU: military unit 67606 (S2 Grupo)
7. WatchGuard Firebox Race Condition and Use-After-Free in Mobile VPN with IKEv2 LDAP Authentication - (WatchGuard Technologies)
8. Unauthenticated Stored XSS in NEX-Forms Express WP Form Builder (≤ 9.1.10) — CVSS 8.8 High (CVE-2026–10525) (Sai Krishna Kothapalli)
9. Bad Epoll: The bug missed by Mythos (Jaeyoung Chung)
10. Fake Google and Cloudflare verification pages spread multiple malware families (Malwarebytes)
11. PamStealer: macOS Malware Posing as Clipboard Manager App (Jamf)
12. FBI Seizes NetNut Proxy Platform, Popa Botnet (Brian Krebs)
13. The Blind Spot in the Watchtower: Detections for When Someone Attacks Your Sentinel (Alex Teixeira)
14. Knossos: Procedurally Generated Decoy Environments (Praetorian)
15. Building more resilient CNI: what industry penetration testers told us (National Cyber Security Centre (NCSC))
16. On Favicons: From Browser Icons to Attack Surface Intelligence (Bishop Fox)
17. OpenUDC2: This is an open source implementation of the UDC2 spec used in Cobalt Strike (CodeXTF2)
18. tf-mythic-azure: Automatically deploying Mythic C2 in Azure using Terraform (qmadev)
19. Not very gentlemanly: Analyzing a zero-day exploit used by The Gentlemen ransomware to disable targets’ EDRs (Expel)
20. Boss Scam: Don’t Trust Every “Urgent” Message from Your Boss! - "It runs in the background till it finds an active WhatsApp Web session in Chromium-based browsers" (K7 Labs)

ARTICLES COVERED:

1. Espionage Against the European Parliament: Member of Committee Investigating Spyware Hacked with Pegasus - The Citizen Lab (The Citizen Lab)
2. Accelerating EDR Evasion with LLM-Driven Analysis (SpecterOps)
3. ARToken: Inside an EvilTokens affiliate panel targeting Microsoft 365 (Cisco Talos)
4. GadgetSniper: Precision call-stack spoofing gadget hunter for x64 DLLs, powered by Iced disassembler (ZakiPedio)

ARTICLES COVERED:

1. PolinRider: North Korea-Linked Supply Chain Campaign Expands Across Open Source Ecosystems (Socket)
2. Iran-Nexus TAG-182 Disseminates MarkiRAT Surveillance Tool (Recorded Future)
3. Kibana 7.17.15, 8.11.1 Security Update (ESA-2026-53) - Improper Output Neutralization for Logs in Kibana can lead to log injection via Log Injection-Tampering-Forging (Elastic)
4. skewrun: Active Directory time discovery protocols for red teams. Stealthy extraction via Kerberos, SMB, NTLM, and CLDAP. (JVBotelho)
5. Don’t pay the ransom: Warning to organisations to protect themselves from ransomware attacks as more than 320 businesses affected last year (City of London Police)

ARTICLES COVERED:

1. How the ToddyCat APT group gains access to Gmail accounts (Kaspersky Lab)
2. Lazarus-Linked npm Malware Masquerades as Rollup Polyfills (JFrog)
3. AI Security Incident Case: Miasma Worm Attacked Microsoft GitHub (NSFOCUS)
4. JADEPUFFER: Agentic ransomware for automated database extortion (Sysdig)
5. CredSpy: Entra ID user enumeration and auth method discovery via the public GetCredentialType API (Keanu Nys)
6. Fortinet Vulnerability CVE-2026-35616 and EKZ Stealer, Attacking Obfuscating Compilers with Binary Ninja Workflows (eSentire, Inc.)
7. ARToken: Inside an EvilTokens affiliate panel targeting Microsoft 365 (Cisco Talos)
8. Anatomy of an Attack: VIPERTUNNEL (ExtraHop)
9. Hollow: hollow is a shellcode loader generator. You give it a raw shellcode binary and a profile, and it spits out a compiled Windows PE loader with your shellcode encrypted inside. (Chaelsoo)
10. SpotifyC2: SpotifyC2 is a cybersecurity research project that demonstrates cloud-based command communication using Spotify playlists for command retrieval and Telegram for output delivery (NirvanaOn)
11. RustDuck: An In-Depth Analysis of a Two-Stage Botnet (Qianxin XLAB)
12. Alleged Member of Criminal Cyber Hacking Group “Scattered Spider” Arrested in Finland and Extradited to the United States (United States Department of Justice)
13. A Djinn in the Machine: TaskWeaver’s Node.js Intrusion Chain (Blackpoint Cyber)

ARTICLES COVERED:

1. The Morris Worm: When a Graduate Student Broke the Internet (Historical Archive)

ARTICLES COVERED:

1. Mustang Panda targets India's government and energy sectors with ZOHOMURK and MINIRECON (Acronis)
2. SOCRadar has attributed FortiBleed to the Lynx / INC ransomware group (SOCRadar® Cyber Intelligence Inc.)
3. From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira - The DFIR Report (The DFIR Report)
4. Hijacked npm Packages Use Novel VSCode Autorun and Blockchain Dead Drops to Deploy a Credential/Crypto Stealer (JFrog)
5. The Biometric AuthToken Heist: Cracking PINs and Bypassing CE via a Long-Ignored Attack Surface (Android) (DARKNAVY)
6. pagecache-lpe-containment-kit: defensive kit for two Linux page-cache-corruption LPEs (DirtyClone CVE-2026-43503, pedit COW CVE-2026-46331): hardening, detection, verification, seccomp + validation (Douglas Mun)
7. ipv6_frag_escape: Linux LPE - Reliable Jail/Container Escape (sgkdev)
8. Dumping LSASS Without Touching Disk: Improvements to ShadowDumper (Practical Security Analytics LLC)
9. About Hypervisor Cheats, Part 2: EPT/NPT, Split Views, and Second-Stage Fault Evidence (Kernullist)
10. Anatomy of a WHQL-Signed Windows Filtering Platform (WFP) Kernel-Resident Network Backdoor (www.nextron-systems.com)
11. Modern Adventures in Azure Privilege Escalation (NetSPI)
12. Mark-of-the-Web: the rules changed, the tools didn’t (Maxim Suhanov)

ARTICLES COVERED:

1. Understanding Trends & Patterns In Insider Threat: Analysis Of 1,000+ Cases (Jawed Karim)
2. Operation DragonReturn: China-Nexus Cyber Espionage Campaign Targeting Govt. of India/MoF Tax Infrastructure via Multi-Stage DcRAT Deployment (Seqrite)
3. AsyncRAT Family Threat Overview (Censys)
4. Proxmox and Adversaries (ZombieLucy)
5. Control who and what triggers GitHub Actions workflows - GitHub Changelog (GitHub)
6. Inside StegoAd: How a Threat Actor Evolved to Fuel Silent Ad Fraud and Credential Theft at Scale (Orenda Security LLC)
7. From CI/CD to Cloud Data: How Shai Hulud Persistence Leads to Redshift Breach (Fortinet, Inc.)
8. CVE-2026-11374: Account takeover vulnerability in ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus (ManageEngine)
9. CrystalSliver: Crystal Palace Evasion kit for Sliver (Simone Licitra)
10. khaos-c2: KHAOS is a modern C2 framework that routes agent traffic through cloud services already trusted by enterprise networks. (28Zaaky)
11. Time Travel Debugging with Codex (SpecterOps)
12. Harnessing Harnesses - Climbing the LLM Hills (ZephrSec)
13. Customer & Partner Updates: Remote Code Execution Vulnerability in PTC’s Windchill and FlexPLM Solutions | June 2026 | PTC (PTC)

ARTICLES COVERED:

1. Internet Crime Complaint Center (IC3) | Russian Intelligence Services Continue to Target Commercial Messaging Applications (Internet Crime Complaint Center (IC3))
2. LOTSを活用して進化を続けるKimJongRAT – KimJongRAT continues to evolve by utilizing LOTS (Internet Initiative Japan Inc. (IIJ))
3. security-audit-skill: A coding-agent skill for multi-phase security audits with independently verified, machine-readable findings (Cloudflare)
4. a CVE dispute (Daniel Stenberg)
5. CVE-2026-45504: CVE-2026-45504 Microsoft Exchange File Read - allows an authenticated low-privileged user to read arbitrary local files from the Exchange server by creating an EWS ReferenceAttachment (Hawktrace)
6. gluegate: Memory API proxy via signed mozglue.dll - Detection research PoC: proxy memory operations (memory mapping, local memory allocation) through Mozilla's signed mozglue.dll (sbousseaden)
7. heavener: This is what happens when you can't afford EDR licenses (Otter)
8. One Bool. Six Shells. AMSI’s Design Problem. (Evariste (bl4ckarch))

ARTICLES COVERED:

1. Cyber Prevent: A descriptive evaluation of cohort reoffending (National Crime Agency)

ARTICLES COVERED:

1. Using SASE in a Modern TIC 3.0 Solution (Cybersecurity and Infrastructure Security Agency)
2. SBU and FBI exposed Russian special services in systematic attempts to "hack" messengers of officials in Ukraine, Europe and the USA (Служба безпеки України)
3. Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances (ESET)
4. Tracking UAC-0226 Tooling Evolution: From WinRAR ADS to Reflective GIFTEDCROOK Loading (Robin Dost)
5. UNC5792 – Rewards For Justice (U.S. Department of State)
6. Russia Breaks Into Human Rights Activist's Phone With Cellebrite - The Citizen Lab (The Citizen Lab)
7. CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure (Palo Alto Networks)
8. StrikeShark: a new campaign involving a custom SharkLoader and Cobalt Strike Beacon (Kaspersky)
9. Analysis of APT-C-36's Recent Activities in Colombia (Intelligence-Group)
10. Lazarus Targets the Financial Sector with Memory-Only Malware Toolset (Cognyte Software Ltd.)
11. Miasma Returns: Leo Platform Compromise in npm (Sonatype Security Research Team)
12. Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access (Microsoft)
13. Director-General's Annual Threat Assessment 2026 - "We discovered nation state hackers had compromised the network of an Australian critical infrastructure provider." (Australian Security Intelligence Organisation)
14. Backdoor.Mistic: New Backdoor May be Linked to Ransomware Access Broker (Broadcom)
15. DCloud Uni-App: One Framework, 236,000+ Scam Sites (Infoblox)
16. Zero-Day Exploitation of Vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager (Google Cloud (Mandiant))
17. From context_handle to type confusion - A Type Confusion Vulnerability Pattern in Windows RPC Servers (Whereisk0Shl)
18. codfish/semantic-release-action GitHub Action has been compromised (StepSecurity)
19. LoaderClient Malware Analysis: How WeedHack Uses Ethereum Smart Contracts for Resilient C2 Infrastructure (Buguard)
20. KuinaExtractor: Six Months of a Rust Infostealer's Evolution (Threatray)
21. Disposable Tooling: Building LLM-Generated Mythic Agents from Prompt to Deployment (SpecterOps)
22. Trust No One: Automating macOS Privilege Escalation at Scale (XM Cyber)
23. LACUNA Chain: Ghost Frames — defeats all EDR layers of call-stack-based detection (Mohamed Alzhrani)
24. Harnessing the Power of Cobalt Strike Profiles for EDR Evasion (White Knight Labs)
25. Release Obfusk8 v1.5 (x86byte)
26. Target Flags - Apple Security Research - "Target Flags are a new security research capability in Apple operating systems that make it easier to objectively demonstrate your findings" (Apple)
27. Testing AI Threat Hunting against Real-World KQL: A Side-by-Side Test (Alex Teixeira)
28. The Latest Addition to Turla’s Intelligence Gathering Apparatus (Google)

ARTICLES COVERED:

1. Reconnaissance Scanning Tools Used by Chinese Threat Actors and Those Available in Open Source (Natto Team)
2. SindriKit: A foundational C library for building operationally credible offensive capabilities (youssefnoob003)

ARTICLES COVERED:

1. Dismantling Fortibleed: Inside a Russian Fortinet compromise operation (socradar.io)
2. HoneyWire: HoneyWire: The Open-Source, Unlimited Deception Platform. Turn any Linux machine into an enterprise-grade canary in 60 seconds. (Andrea Termine)
3. CVE-2026-41089: CVE-2026-41089 PoC — Netlogon CLDAP stack buffer overflow (CVSS 9.8 CRITICAL) - only a Denial of Service PoC not RCE (0xABCD01)
4. Ghost-Sender - Universal Email Spoofing against Exchange Online (InfoGuard AG)
5. macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox (SentinelOne)
6. From Langflow to Monero: Inside CVE-2026-33017 Cryptominer (Trend Micro)

ARTICLES COVERED:

1. CISA Urges Hardening Fortinet Devices After Reports of Credential Exposure (Cybersecurity and Infrastructure Security Agency)
2. Analysis of Reported Credential Compromise of FortiGate Devices (Fortinet, Inc.)
3. From package to postinstall payload: Inside the Mastra npm supply chain compromise by Sapphire Sleet (Microsoft)
4. Klue Third-Party Cybersecurity Incident (Jamf)
5. Two men plead guilty over £39m Transport for London cyber attack (BBC)
6. From PostCSS Masquerading to Windows RAT (JFrog)
7. Nearly Half of LG Smart TV Apps Contain Residential Proxy SDKs (Spur Intelligence Labs)
8. Bypassing Conditional Access policies that have a resource exclusion (Dirk-jan Mollema)
9. Prevent data exfiltration: AWS egress controls for cloud workloads | Amazon Web Services (Amazon Web Services)
10. Securing the Nation Against Advanced Cryptographic Attacks (The White House)
11. Using the Cert Graveyard (Rogue Authority LLC)
12. GhostShell (MB-0009): Targeting Ukraine’s UAV Operations and Defense Supply Chain (Synaptic Systems)
13. Security Update: Tanium’s Response to the Klue Breach that Allowed Data Exfiltration from Salesforce | Tanium (Tanium)

ARTICLES COVERED:

1. UK Cybercrime Journal: Sustained DragonForce Campaign (BushidoToken)
2. Unveiling ErrTraffic: inside a growing ClickFix malware distribution framework (Sekoia.io)
3. The Booking.com Phishing Campaign Targeting Hotels and Customers (Bridewell)
4. Mind the Gap: GCP serviceData in Logs Explorer vs. Exported Logs (Permiso Security)
5. Azure AD Graph Activity Logs: detecting directory enumeration (Elastic)
6. Reduce Microsoft Sentinel Costs with Summary Rules (NVISO)
7. OSS Artifact Scanning at Scale Without Burning Your Token Budget (Nextron Systems)
8. An Update on the Recent Klue Security Incident - Klue (Klue)
9. A Forgotten Contributor Account Compromised the Entire Mastra npm Package Scope (Snyk)
10. Inside the FortiBleed Open Directory: A Technical Analysis of What the Attacker Left Behind (CloudSEK)
11. NOW: NØW is a word-based shellcode encoding and obfuscation tool that transforms raw shellcode bytes into natural-looking English prose. (Nirvana)
12. GhostPack Necromancy: Reforging C# Tools with WasmForge (Praetorian)
13. Harnessing the Power of Cobalt Strike Profiles for EDR Evasion – Part 3 (White Knight Labs)
14. RoguePlanet and GreatXML: Detecting Local Privilege Escalation and BitLocker Security Boundary Abuse (LevelBlue)
15. Threat Brief: Mitigating Large-Scale Credential Attacks (Palo Alto Networks)
16. macOS ClickFix Lures Deploy AppleScript Stealer & Persistent RAT (Netskope)
17. asftriage: LLM Agent Session Forensics Tool - A forensic investigation tool for AI agent session logs (Claude Code and Codex CLI). (OA Labs)
18. OXLOADER: new loader evading detection to drop infostealer (Elastic)
19. Composer & Packagist Supply Chain Security in 2026 (Nils Adermann)
20. Man jailed for role in “SMS Blaster” fraud operation following City of London Police investigation (City of London Police)
21. Inside Vidar’s ABE Bypass: From Memory Scanning to APC Injections (Gen Digital)
22. Scripting the disassembler: Local agentic reverse engineering through vbdec’s live COM object model (Cisco Talos)

ARTICLES COVERED:

1. Fable 5 Cybersecurity benchemark (Graphistry)
2. astro.config.mjs Supply Chain Attack via Blockchain C2 (SafeDep)
3. Captured Logs Reveal Hackers Using Claude and Codex to Breach Companies (OALABS)
4. The Klue Security Incident and Its Impact on Recorded Future (Recorded Future)
5. DSA-2026-197: Security Update for Dell Client Platform BIOS for a Weak Encoding for Password Vulnerability (Dell Technologies)
6. Introducing usbliter8: Apple iPhone A12/A13 SecureROM exploit (Paradigm Shift)
7. Squidbleed (CVE-2026-47729) (Calif.io)
8. Bring Your Own Everything: Traitorware (Print3M)
9. More Than 4,000 Legacy Routers Compromised by AryStinger, Turned into Global Attack Proxies for Hackers (QiAnXin XLab)
10. Multiple JetBrains IDE plugins caught stealing AI keys (Aikido)
11. Popa: From Sourcing to Distribution (Synthient)
12. Deobfuscation in the Age of Agentic Reverse Engineering (Tim Blazytko and Nicolò Altamura)
13. ktrace: Speakeasy-based Windows kernel-mode driver API tracer (struppigel)
14. SELECT * FROM binary - Vibe Reversing Across IDA, Ghidra, and Binary Ninja (Elias Bachaalany)
15. From Stars to Upvotes: Fake Reputation Fueling a Crypto Clipboard Hijacker (Check Point Research)
16. Ransomware gangs cut off from EUR 336 million ‘AudiA6’ crypto laundering pipeline – Europol analysis links the criminal service to over 15 international cybercrime investigations | Europol (Europol)

ARTICLES COVERED:

1. APT Organization Research Yearbook (2026 Edition) - Chinese (绿盟科技、广州大学网络空间安全学院)
2. Cybercrime Breaches Klue: Salesforce Data Impacted for Many Victims, including Huntress | Huntress (Huntress)
3. Operationalizing browser exploits to bypass Windows Defender Application Control (WDAC) (IBM)
4. RawHive: Cobalt Strike BOF that extracts selected Windows registry hives directly from a raw NTFS volume by parsing NTFS metadata and reading file data straight from disk. (nmht3t)
5. PhantomCtx: Activation Context Hijacking Evasion Tool (r3xmax)
6. Using Slack links-preview to smuggle C2 in locked-down environments. (RWXstoned)
7. git-clean-filter: This is a proof-of-work for abusing git's clean filter against IDEs & Sublime. (RootUp)
8. Internet Crime Complaint Center (IC3) | Cyber Criminals Redirecting Users to Fraudulent Websites with Malicious Traffic Distribution Systems (Federal Bureau of Investigation (FBI))
9. Building a Modern Detection Pipeline with ContentOps (Gianni Castaldi)

ARTICLES COVERED:

1. International law enforcement initiate hunt on malware group SocGholish (Dutch police (Politie))
2. UnCanny: Another new coercion primitive with LPE 0day - machine-account NTLM coercion from a non-admin user via Windows Store InstallService plugin resolution experiments (0xHossam)
3. Bluekit Phishing as a Service (PhaaS) (CloudSEK)
4. Killing me gently: Inside Gentlemen’s EDR killer framework (ESET)