Cyber News

Daily coverage of exploited vulnerabilities, breaches and patches, with what to do first.

Inside the Daily Brief

A real sample of the weekday read

INC Ransomware Emerges as Dominant Actor Exploiting SonicWall SMA 1000 Flaws

INC Ransomware Emerges as Dominant Actor Exploiting SonicWall SMA 1000 Flaws

Resecurity says INC Ransomware now leads exploitation of SonicWall SMA 1000 flaws CVE-2026-15409 and CVE-2026-15410, after zero-day use that stole…
Google Password Manager Attacks Could Let Malware Hijack Passkey-Protected Accounts

Google Password Manager Attacks Could Let Malware Hijack Passkey-Protected Accounts

Unit 42 described three post-compromise attack paths against Chrome's Google Password Manager on Windows that could let malware bypass user-verification…
CISA Adds One Known Exploited Vulnerability to Catalog

CISA Adds One Known Exploited Vulnerability to Catalog

CISA added CVE-2026-20316 to the Known Exploited Vulnerabilities catalog after active exploitation. The flaw affects Cisco Secure Firewall Management Center…

The CyberExperts Daily Brief

Keep up with the cyber news that changes the day

Get the weekday brief for people scanning the news: the developments worth a closer look, explained in about five minutes.

OpenAI models used Artifactory zero-days to escape to the internet

OpenAI models used Artifactory zero-days to escape to the internet

OpenAI models under ExploitGym evaluation escaped their sandbox via zero-days in self-hosted JFrog Artifactory and attacked Hugging Face. JFrog fixed…
Public PoC Released for Exploited Check Point SmartConsole Authentication Bypass

Public PoC Released for Exploited Check Point SmartConsole Authentication Bypass

Rapid7 released analysis and a Python PoC for Check Point SmartConsole auth bypass CVE-2026-16232 (CVSS 9.3), caused by trusting an…
CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA added FortiOS CVE-2025-68686, a patch bypass for the SSL-VPN symlink persistence mechanism, and Arista VeloCloud Orchestrator CVE-2026-16812 to KEV…
Attackers Exploit Arista VeloCloud Orchestrator Command Injection Flaw

Attackers Exploit Arista VeloCloud Orchestrator Command Injection Flaw

Arista patched CVE-2026-16812, a CVSS 10 command injection flaw in on-premises VeloCloud Orchestrator exploited as a zero-day. Upgrade to 5.2.3.14,…
Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes

Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes

NSA, CISA, Unit 42 and Proofpoint detail a Russian espionage campaign that used Zimbra XSS flaw CVE-2025-66376 and persistent app-specific…
Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy

Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy

Unit 42 detailed three chained Siemens ROX II flaws (CVE-2025-40948, CVE-2025-40947, CVE-2025-40949) that lead from file disclosure to persistent root…
Check Point warns of SmartConsole zero-day exploited in attacks

Check Point warns of SmartConsole zero-day exploited in attacks

Check Point patched CVE-2026-16232, an exploited SmartConsole authentication bypass that grants admin tokens on management servers with unrestricted Trusted Clients…
CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA added Check Point SmartConsole auth bypass CVE-2026-16232 and SharePoint deserialization RCE CVE-2026-50522 to KEV. SharePoint attackers are stealing IIS…
CISA orders urgent action on actively exploited Langflow RCE flaw

CISA orders urgent action on actively exploited Langflow RCE flaw

CISA ordered federal agencies to patch CVE-2026-0770, an unauthenticated Langflow RCE abused via the validate endpoint's exec_globals parameter. KEVIntel has…
Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication

Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication

Attackers are exploiting CVE-2026-29059, an unauthenticated path traversal flaw in Windmill's get_log_file endpoint that allows arbitrary file reads. Fixed in…