A CVSS 9.8 FortiMail zero-day (CVE-2026-104286) lets an unauthenticated attacker write any file on the appliance through the IBE handler. Here is what is affected, how to check for compromise, and how to fix it.
Category: Blog
The Credential You Published on Purpose: How an Exposed GitLab Email Token Becomes Push Access to Main
A GitLab incoming email token published in a README never expires and works at account level. Learn how the attack path works, how to reset the token, and how to audit your repositories.
Two NetScaler Zero-Days, One Wrong Assumption: Why Patching Does Not Close the Incident
Citrix fixed two actively exploited NetScaler zero-day flaws, but a patch does not remove an attacker already inside. Seven steps from patch to closure.
CVE-2026-76461: Cisco Secure Email Gateway SQL Injection Zero-Day Under Active Exploitation
A CVSS 9.8 SQL injection in Cisco Secure Email Gateway (CVE-2026-76461) lets an attacker gain root access with a single crafted email — no authentication, no workaround. Here’s what’s exploitable, what to check, and how to patch.
The Leak Site Got Breached: What ShinyHunters’ Takeover of Clop Means for the Companies Listed on It
ShinyHunters says it breached Clop’s ransomware leak site and holds the keys to its Tor onion service. Here’s what that means for every organisation still listed on it.
Your Identity Programme Was Built for People. Non-Human Identity Is Now the Leading Way In.
New research shows compromised non-human identity now drives more breaches than phishing. See why service accounts, API keys, and AI agents are the entry point most identity programmes still cannot see.
The Phishing Came From Your Real Domain: What a Marketing Platform Breach Does to Brand Trust
An attacker breached a marketing platform and sent phishing emails from a hardware wallet maker’s genuine domain to 347,000 subscribers. Every technical control that checks for forgery passed, because nothing was forged.
Passwordless Is Not Takeover Proof: Where Passkey Attacks Actually Land
Passkey attacks published this year do not break the cryptography. They target the sync fabric, the recovery path, and the enrolment step instead — the parts a passwordless migration usually leaves unmonitored.
Your Security Vendors Are Your Highest-Privilege Third Parties, and Your TPRM Program Scores Them Low
Security vendors sit at the top of the privilege ladder, yet TPRM programs consistently score them low because certification substitution and category heuristics mask the real question: what does an attacker inherit if this vendor is compromised?
Agentic Ransomware: What Happens When Malware Doesn’t Need a Human Operator to Decide Who to Hit Next?
A documented ransomware operation completed reconnaissance, credential theft, lateral movement, and encryption with no human operator at any stage. This analysis breaks down the JADEPUFFER intrusion end to end: the Langflow vulnerability that opened the door, how an autonomous LLM agent adapted mid-attack, and what defense architecture needs to look like when breakout is measured in minutes.