Curated intelligence at the intersection of offensive security and AI — the latest items, newest first. See Top Picks for the highest-impact stories.

Friday, August 14, 2026

CRITICALMaximum Severity SAP Commerce Cloud Flaw Actively Exploitedsap · rce · exploit · vulnerabilityHIGHAPT Group HoneyMyte Upgrades CoolClient with Kernel-Level Windows Rootkitapt · rootkit · malware · windowsCRITICALCitrix NetScaler Pre-Auth RCE Vulnerability Disclosedcitrix · rce · pre-auth · vulnerability

Wednesday, August 12, 2026

CRITICALAPI Flaw in OpenAI, Anthropic, Google AI Models Exposes Internal Reasoning and Secretsai · api · data-leak · vulnerabilityCRITICALAdobe Patches Critical ColdFusion and Campaign Classic Flawsadobe · coldfusion · rce · vulnerabilityCRITICALAttackers Actively Exploiting VMware vCenter Vulnerability for Persistent Accessvmware · vcenter · rce · exploit

Tuesday, August 11, 2026

CRITICALMicrosoft Patches 398 Flaws, Including a Windows Driver Zero-Day Under Active Attackmicrosoft · patch-tuesday · zero-day · privilege-escalationHIGHKimwolf v7 Android Botnet Uses HTTP/2 DDoS and Ethereum ENS for Resiliencebotnet · android · iot · ddosCRITICALAI-Assisted Exploit Chain Achieves Unauthenticated RCE in SharePointsharepoint · rce · ai · vulnerabilityHIGHDeadLock Ransomware Uses Polygon Smart Contracts for Extortion Infrastructureransomware · blockchain · polygon · extortionHIGHOpenAI Launches GPT-5.6-Cyber for Exploit Development with Reduced Safeguardsopenai · ai · offensive-security · exploit-developmentCRITICALMalicious SIM Cards Can Execute Attacker Code on Cellular IoT Devicesiot · sim-card · rce · critical-infrastructureHIGHMozilla Revokes Firefox and Thunderbird Linux Signing Key After Exposuremozilla · firefox · supply-chain · cryptographyHIGHHead Mare APT Exploits Unpatched TrueConf Server to Deliver Backdoorsapt · trueconf · backdoor · exploitHIGHMalicious MCP Servers Can Exfiltrate Secrets from AI Coding Agentsai · supply-chain · data-exfiltration · coding-agentsHIGHProject CAV3RN Continues with Google Apps Script C2 and DNS-based Routingapt · c2 · google-apps-script · evasionCRITICALHackers Breach Polish Power Plant via Private Cellular Network, Shut Down Turbinecritical-infrastructure · ot · breach · cellular-network

Saturday, August 8, 2026

HIGHHackers Breach TrueConf, Trojanize Client Installers with Backdoorssupply-chain · trojan · backdoor · trueconfCRITICALMetabase Zero-Day SQLi Actively Exploited for Data Theftzero-day · sql-injection · data-breach · metabaseHIGHN-able Issues Hotfixes for N-central Exploitationrmm · exploitation · hotfix · n-ableCRITICALProgress Kemp LoadMaster Flaw Added to CISA KEV After Exploitationcve · command-injection · kev · progress-kemp

Friday, August 7, 2026

CRITICALNearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealernpm · supply-chain · malware · infostealerHIGHClickFix Attacks Deploy macOS Stealer for Crypto and Credential Theftmacos · malware · cryptocurrency · infostealerHIGHUNC6671 Vishing Attacks Target Personal Phones for SaaS Data Theftvishing · social-engineering · data-exfiltration · threat-actorMEDIUMLevi Strauss & Co. Suffers Corporate Data Theft via Social Engineeringsocial-engineering · data-breach · corporate-security · levi-strauss