Threat intel
Daily cybersecurity news, vulnerability advisories, and threat briefings on cloud credential theft, ransomware, zero-days, and the attack patterns we track in the field.
No published articles yet. Check back soon.
A new feature in the onedump.py utility enables bulk extraction of embedded files from OneNote .one documents into JSON, streamlining malware analysis. Defenders can now process large volumes of attachments, filter by hash, and write suspicious payloads to disk for further inspection.
Read briefingA memory corruption flaw in Chromium's cache handling (CVE-2026-118352) can allow attackers to execute arbitrary code. The issue affects all Chromium‑based browsers, including Microsoft Edge and Google Chrome, until patched. Defenders should verify patch status, update browsers, and monitor for anomalous memory activity.
Read briefingA critical use‑after‑free flaw in Chromium’s FileSystem API (CVE‑2026‑118347) can lead to memory corruption and potential code execution. Microsoft Edge (Chromium‑based) inherits the vulnerability. Immediate patching of all affected browsers is required.
Read briefingA critical use‑after‑free flaw in Chromium’s animation engine can allow attackers to execute arbitrary code via crafted web content. Microsoft Edge (Chromium‑based) and Google Chrome versions prior to 121 are vulnerable. Immediate patching and disabling of animations is recommended.
Read briefingA critical input‑validation flaw in Chromium’s ANGLE component (CVE‑2026‑118329) could allow attackers to execute arbitrary code via crafted web content. Microsoft Edge and Google Chrome users on versions prior to the latest patch are affected. The following briefing outlines the impact, affected systems, and recommended mitigation steps.
Read briefingMicrosoft Edge (Chromium-based) is affected by CVE‑2026‑118333, a missing authorization flaw in video processing that could allow unauthorized access to protected media. Edge users should update to the latest version and review video source policies. Defenders should monitor for anomalous video requests and enforce strict content controls.
Read briefingA use‑after‑free flaw in Chromium’s rendering engine, now present in Microsoft Edge, can lead to arbitrary code execution or denial‑of‑service. All Edge users must update to the latest release. Defenders should enable auto‑updates, block malicious sites, and monitor for exploitation attempts.
Read briefingMicrosoft Edge users face a memory‑corruption flaw in Chromium’s media subsystem. The vulnerability, CVE‑2026‑118327, can lead to arbitrary code execution if an attacker serves crafted media. Defenders must update Edge and monitor for exploitation attempts.
Read briefingA memory corruption flaw in Chromium’s FileSystem module (CVE‑2026‑118306) can lead to arbitrary code execution. Microsoft Edge and other Chromium‑based browsers are impacted. Defenders should update immediately, monitor for anomalous activity, and apply mitigations where possible.
Read briefingMicrosoft Edge has inherited a critical flaw in the V8 JavaScript engine (CVE‑2026‑118316) that can allow attackers to execute arbitrary code. The issue is fixed in the latest Edge releases; earlier versions remain vulnerable. Defenders should update Edge immediately and monitor for anomalous browser activity.
Read briefingA use‑after‑free flaw in Chromium’s video decoder can allow attackers to execute arbitrary code during media playback. The vulnerability is present in all browsers built on Chromium, including Microsoft Edge, and is mitigated by the latest security updates. Defenders should verify patch status, monitor for exploitation attempts, and enforce strict content security policies.
Read briefingChainalysis confirmed an external actor accessed non-sensitive customer data via AI-powered agentic techniques. No investigation content or credentials were compromised. Defenders should audit access controls, monitor logs, and harden AI-driven threat defenses.
Read briefingA tampered Claude Code extension appeared in the Cursor marketplace, adding an attacker‑controlled SSH key and establishing a persistent backdoor. Systems that installed the extension during the 11‑hour window are at risk. Defenders should inventory, remove the extension, delete malicious keys, and monitor for reverse tunnels.
Read briefingOperation Blackout was a coordinated law‑enforcement effort that shut down a network of scam centers in West Africa. The operation demonstrates the power of public‑private collaboration and provides concrete steps for defenders to harden against similar threats. SecOps teams should review their threat‑intel feeds, patch management, and incident‑response playbooks in light of these findings.
Read briefingAn origin‑validation flaw in BeyondTrust Remote Support allows unauthenticated attackers to upload files and execute code as the OS user. The vulnerability is triggered through the public session‑start endpoint and affects version 24.1.2 build 1524046. Defenders should verify appliance versions, apply patches, disable the public endpoint, and monitor for anomalous file writes.
Read briefingA critical local privilege‑escalation flaw in Microsoft Edge (Chromium‑based) allows a malicious web page or file to execute code with SYSTEM privileges. The vulnerability affects Edge 121‑123 and is fixed in version 124.0.2420.0. Defenders must update Edge and review WebView2 usage immediately.
Read briefingBinance suffered the largest recorded crypto theft, losing $6.3 billion after a DevOps engineer’s laptop was compromised. The incident highlights credential misuse and the need for rigorous device security. Defenders should audit access controls, enforce MFA, and monitor for anomalous withdrawal patterns.
Read briefingBinance disclosed that a compromised DevOps engineer’s laptop enabled attackers to forge withdrawal requests, draining roughly $6.3 billion. The breach involved privilege escalation and lateral movement, not a stolen wallet key. Defenders should enforce MFA, isolate privileged endpoints, and monitor for anomalous API activity.
Read briefingA $5 deepfake fraud kit has infiltrated multiple enterprises, using synthetic media to impersonate executives and steal funds. Detection alone fails because the kit’s lightweight payload evades signature‑based tools. Defenders must adopt layered media analysis, zero‑trust policies, and continuous threat intelligence.
Read briefingCrowdStrike has introduced Agent Graph, a feature within Falcon Guardian that maps the execution paths of AI agents on endpoints. This tool allows defenders to distinguish between intended agent instructions and actual system actions, addressing visibility gaps in agentic AI deployments.
Read briefingCrowdStrike has extended its Falcon Adversary OverWatch managed threat hunting service to include 24/7 coverage of AI applications and autonomous agents, as well as enhanced telemetry‑driven hunting for Google Cloud environments. The update provides defenders with deeper visibility into AI‑driven attacks and cloud‑native threats, enabling faster detection and response. Security teams should enable the new features, review agent telemetry, and adjust monitoring policies accordingly.
Read briefingCrowdStrike has broadened its Falcon Adversary OverWatch service to include 24/7 managed threat hunting for AI applications and deeper telemetry for Google Cloud environments. The update gives defenders continuous visibility into AI‑driven attacks and cloud‑specific vectors, enabling proactive detection and response.
Read briefingCrowdStrike’s Falcon Next-Gen SIEM merges real‑time telemetry with curated threat intelligence, enabling security teams to detect, investigate, and remediate attacks faster. The platform supports agentic SOC workflows and AI‑enhanced triage across on‑prem, cloud, and hybrid environments.
Read briefingCrowdStrike has broadened its Falcon Adversary OverWatch service to include 24/7 managed hunting for AI-driven applications and autonomous agent activity, while adding deeper telemetry‑driven hunting capabilities for Google Cloud environments. The update equips defenders with real‑time visibility into emerging AI threats and cloud workloads, enabling faster detection and response. Security teams should integrate the new hunting modules, review agent telemetry, and adjust cloud security controls accordingly.
Read briefingLoading more…
End of results
