CTI Daily Brief: 2026-05-18 - Suspected npm/PyPI Supply Chain Wave, CISA GovCloud Credential Leak, SHub Reaper macOS Infostealer

Suspected large-scale npm/PyPI supply chain campaign tracked by Upwind alongside TeamPCP Mini Shai-Hulud activity; CISA contractor exposes AWS GovCloud credentials on public GitHub; SHub ‘Reaper’ macO...

intel.overresearched.net

CTI Weekly Brief: 11 to 17 May 2026 - Actively exploited Cisco SD-WAN zero-day, npm supply-chain worm hits TanStack/UiPath, Windows BitLocker and MiniPlasma zero-days, and a Qilin/Chaos/Stormous RaaS ...

CISA-mandated emergency patching of Cisco SD-WAN CVE-2026-20182; coordinated npm/PyPI supply-chain compromises (TanStack, UiPath, Mistral, node-ipc) by TeamPCP and a separate maintainer-account hijack...

intel.overresearched.net

CTI Daily Brief: 2026-05-17 - Unpatched Windows MiniPlasma zero-day grants SYSTEM; Chaos and Qilin RaaS dominate ransomware activity

An unpatched Windows privilege escalation zero-day (MiniPlasma) with a public PoC anchors a high-severity day dominated by Chaos and Qilin Ransomware-as-a-Service activity; Pwn2Own Berlin 2026 closed ...

intel.overresearched.net

CTI Daily Brief: 2026-05-16 - Qilin hits Argentine medical centre; Beast and Lamashtu RaaS expand victim sets

Five reports in 24h dominated by RaaS activity: Qilin posts a healthcare victim, Beast and Lamashtu add new entries, and Microsoft rejects a critical Azure Backup for AKS privilege-escalation report d...

intel.overresearched.net

CTI Daily Brief: 2026-05-15 - PostgreSQL Critical Patch Cluster, Secret Blizzard Kazuar P2P Botnet, Sustained Qilin/DragonForce Ransomware Spree

Five critical PostgreSQL/libyang CVEs published, Russian FSB-linked Secret Blizzard upgrades Kazuar into modular P2P botnet, and Qilin, DragonForce, Exitium and Coinbase Cartel continue high-tempo ran...

intel.overresearched.net

CTI Daily Brief: 2026-05-14 - Cisco SD-WAN Zero-Day Added to CISA KEV; WordPress Burst Statistics Auth Bypass Under Mass Exploitation; TanStack Supply Chain Hits Mistral and OpenAI

Two critical vulnerabilities under active exploitation (Cisco Catalyst SD-WAN CVE-2026-20182 added to CISA KEV; Burst Statistics WordPress plugin CVE-2026-8181 with 7,400+ blocked attacks in 24h), Tan...

intel.overresearched.net

CTI Daily Brief: 2026-05-13 — Cisco SD-WAN ITW exploitation by UAT-8616, node-ipc supply chain compromise, 18-year NGINX RCE

65 reports across 18 sources: active exploitation of Cisco Catalyst SD-WAN (CVE-2026-20182) by UAT-8616, credential-stealing payload in node-ipc npm (3.35M monthly downloads), 18-year-old NGINX heap overflow CVE-2026-42945, Microsoft May Patch Tuesday including .NET EoP CVE-2026-32177, and CISA’s 13-advisory Siemens/Universal Robots ICS batch.

intel.overresearched.net

CTI Daily Brief: 2026-05-12 — Unpatched BitLocker zero-day PoC, PgBouncer auth bypass, ShinyHunters Canvas extortion

Unpatched Windows BitLocker bypass PoC released; critical PgBouncer authorization flaw (CVE-2026-6667); ShinyHunters Canvas/Canada Life extortion; Nitrogen ransomware confirmed at Foxconn; Shai-Hulud ...

intel.overresearched.net

CTI Daily Brief: 2026-05-11 - Shai-Hulud TanStack supply-chain attack, Copy.Fail Linux LPE, SAP critical patches, Iran’s Seedworm campaign

TeamPCP escalates the Shai-Hulud npm/PyPI supply-chain campaign to TanStack, Mistral and UiPath packages while SAP patches critical Commerce Cloud and S/4HANA flaws. Theori discloses Copy.Fail, a work...

intel.overresearched.net

CTI Daily Brief: 2026-05-10 — Mr_Rot13 weaponises critical cPanel flaw (CVE-2026-41940); ShinyHunters extort Instructure via Canvas XSS; Linux ‘Dirty Frag’ container-escape exploit goes public

Mr_Rot13 (a six-year-old crew) actively exploits CVE-2026-41940 in cPanel with Telegram exfiltration; ShinyHunters re-breach Instructure Canvas to extort schools; Linux ‘Dirty Frag’ (CVE-2026-43284/-4...

intel.overresearched.net

CTI Weekly Brief: 4 May to 10 May 2026 - PAN-OS Zero-Day Exploited In-the-Wild, Linux Kernel Page-Cache Bugs Chain to Root, npm Supply Chain Worm Hits Intercom SDK

Weekly intelligence covering 559 reports across the pipeline: state-sponsored exploitation of PAN-OS CVE-2026-0300, two unpatched Linux LPE chains (Copy Fail and Dirty Frag), Ivanti EPMM zero-day unde...

intel.overresearched.net

Claude

Claude is Anthropic's AI, built for problem solvers. Tackle complex challenges, analyze data, write code, and think through your hardest work.

claude.ai

CTI Daily Brief: 2026-05-08 - Linux page-cache 0-days exploited in the wild; Genesis ransomware burst hits US healthcare and legal sectors

Elastic confirms Copy Fail (CVE-2026-31431) added to CISA KEV; DirtyFrag widens the same bug class across the Linux network stack. Genesis ransomware posts five US victims in one day. Trending Hugging...

intel.overresearched.net

CTI Daily Brief: 2026-05-07 - Apache HTTP/2 RCE & mod_rewrite EoP CVEs; PCPJack cloud worm; Akira ransomware spree (38 victims)

Critical Apache HTTP Server RCE and privilege-escalation flaws lead the day; the PCPJack worm steals credentials at cloud scale by evicting TeamPCP; Akira posts 38 fresh victims spanning healthcare, m...

intel.overresearched.net

CTI Daily Brief: 2026-05-06 — PAN-OS Captive Portal zero-day exploited in-the-wild by CL-STA-1132; FortiClient EMS pre-auth bypass exploit circulating; APT37 deploys BirdCall Android backdoor

Nine reports across eight sources. One critical (FortiClient EMS pre-auth bypass exploit on Telegram), four high-severity items including limited in-the-wild exploitation of PAN-OS CVE-2026-0300 by CL...

intel.overresearched.net

CTI Daily Brief: 2026-05-05 - Palo Alto PAN-OS Zero-Day Under Active Exploitation; Linux ‘Copy Fail’ LPE; APT29, APT37, MuddyWater Activity

Critical PAN-OS CVE-2026-0300 (CVSS 9.3) actively exploited in the wild, Linux kernel ‘Copy Fail’ (CVE-2026-31431) deterministic LPE, APT37 BirdCall Android backdoor, MuddyWater Chaos-decoy espionage,...

intel.overresearched.net

CTI Daily Brief: 2026-05-04 - Weaver E-cology CVE-2026-22679 actively exploited; ShinyHunters dumps Vimeo data; Safepay ransomware surge

25 reports processed. Three critical vulnerabilities (Weaver E-cology CVE-2026-22679 in-the-wild RCE, GNU Binutils CVE-2025-11083, libssh2 CVE-2026-7598). Safepay drives a five-victim ransomware clust...

intel.overresearched.net

CTI Weekly Brief: 27 April to 3 May 2026 - Mass cPanel exploitation, GitHub RCE, APT28 zero-day, ShinyHunters extortion wave

346 reports across 15 sources. Mass-exploited cPanel zero-day driving ‘Sorry’ ransomware; GitHub RCE in core git infrastructure; CISA KEV addition for APT28-exploited Windows NTLM leak; Linux ‘Copy Fa...

intel.overresearched.net

CTI Weekly Brief: 27 April to 3 May 2026 - Mass cPanel exploitation, GitHub RCE, APT28 zero-day, ShinyHunters extortion wave

346 reports across 15 sources. Mass-exploited cPanel zero-day driving ‘Sorry’ ransomware; GitHub RCE in core git infrastructure; CISA KEV addition for APT28-exploited Windows NTLM leak; Linux ‘Copy Fa...

intel.overresearched.net

CTI Daily Brief: 2026-05-02 — cPanel Zero-Day Mass-Exploited in Sorry Ransomware Campaign; Shinyhunters, M3rx, and Everest All Active

26 reports across 5 sources. CVE-2026-41940 cPanel auth-bypass exploited at scale to deploy Sorry ransomware on 44,000+ hosts. Critical libssh2 and binutils RCEs disclosed. Shinyhunters, M3rx, and Eve...

intel.overresearched.net

CTI Daily Brief: 2026-05-01 — Apache MINA RCE, ConsentFix v3 OAuth abuse, CopyFail Linux LPE in active discussion

Two critical Telegram-tracked CVEs (Apache MINA RCE, authentication bypass), automated OAuth phishing against Azure, the CopyFail Linux LPE remains widely unpatched, npm supply-chain campaigns continu...

intel.overresearched.net

CTI Daily Brief: 2026-04-30 — Two Critical Chromium CVEs, ShinyHunters Targets Finance Sector, Unit42 Flags 18 Malicious AI Browser Extensions

Two critical Chromium CVEs (Skia heap overflow, ANGLE use-after-free) lead a 21-CVE Microsoft Edge advisory batch; ShinyHunters claims Aman, Towerpoint Wealth and Follett Software in a finance/hospita...

intel.overresearched.net

CTI Daily Brief: 2026-04-29 - Linux privilege escalation, TeamPCP SAP npm supply-chain attack, dormant WordPress backdoor

23 reports processed across 2 correlation batches. Critical Linux root-escalation CVE, TeamPCP supply-chain compromise of official SAP npm packages, a dormant WordPress backdoor in 70K sites, and acti...

intel.overresearched.net

CTI Daily Brief: 2026-04-28 - LiteLLM SQLi (CVE-2026-42208) actively exploited; ProFTPD CVE-2026-42167 PoC released; TeamPCP linked to VECT 2.0 wiper

Two critical vulnerabilities under active or PoC exploitation (LiteLLM CVE-2026-42208, ProFTPD CVE-2026-42167); TeamPCP threat group ties LiteLLM exploitation to broken VECT 2.0 ransomware acting as a...

intel.overresearched.net

CTI Daily Brief: 2026-04-27 - Critical GitHub RCE (CVE-2026-3854) actively exploitable; ShinyHunters, LAPSUS$ and Qilin dominate ransomware activity

Wiz disclosed CVE-2026-3854, a critical RCE in GitHub.com and GitHub Enterprise Server with 88% of GHES instances still unpatched. ShinyHunters monetised the Anodot supply-chain compromise (Vimeo, Pit...

intel.overresearched.net

CTI Daily Brief: 2026-04-26 - ShinyHunters Leak 1.4M Udemy Accounts; Qilin, Inc Ransom and Tridentlocker Post New Victims

Eight high-severity reports dominated by ransomware leak-site activity from Qilin, Inc Ransom, Tridentlocker and Payload, alongside a ShinyHunters extortion of Udemy exposing 1.4 million accounts and ...

intel.overresearched.net

CTI Weekly Brief: 2026-04-20 to 2026-04-26 - Three CISA KEV additions, ArcaneDoor returns to Cisco Firepower, Qilin RaaS dominates the leak-site economy

611 reports processed across 14 correlation batches. UAT-4356 (ArcaneDoor) deploys FIRESTARTER on Cisco Firepower devices; CISA KEV additions for Microsoft Defender BlueHammer, Cisco SD-WAN, and Apach...

intel.overresearched.net

CTI Daily Brief: 2026-04-25 — Critical Breeze Cache RCE PoC circulating; Qilin, Lockbit5, M3rx ransomware surge

Two critical vulnerabilities lead the day: a public PoC for CVE-2026-3844 (Breeze Cache unauthenticated RCE) circulating on Telegram, and a Linux BPF stack-out-of-bounds write (CVE-2026-23359). Ransom...

intel.overresearched.net

CTI Daily Brief: 2026-04-24 - Shai-Hulud npm worm escalates, UAT-4356 Firestarter persists on Cisco firewalls, UNC6692 abuses Teams to drop Snow malware

Unit 42 details the post-Shai-Hulud npm supply chain landscape with TeamPCP republishing trojanised packages; CISA and NCSC warn that UAT-4356’s Firestarter implant survives Cisco ASA/FTD patching; Ma...

intel.overresearched.net

CTI Daily Brief: 2026-04-23 - Breeze Cache WordPress plugin actively exploited; CISA adds four KEVs; ShinyHunters hits ADT and Carnival

Critical Breeze Cache WordPress RCE under active exploitation, CISA adds four new KEV entries, 10K+ Zimbra servers unpatched, ShinyHunters breaches ADT and Carnival, new BlackFile vishing gang, Pack2T...

intel.overresearched.net