Security News. From Our Analysts.
Security news from the Brandefense team: new malware, vulnerabilities, data breaches and threat actor activity, summarized for security professionals.
Security News Tailworm: Which Tailscale Features Are Exposed, and What to Do Now Tailworm lists 11 Tailscale and headscale findings by researcher Erica Windisch. Tailscale 1.104.4 fixes most; see who is still exposed and what to do. 
Security News 3 Exploited Arista VeloCloud Flaws in 88 Days: What Orchestrator Owners Should Check Arista VeloCloud Orchestrator On-Prem has three exploited flaws since July. See each advisory, the builds that cover all three and the first checks. 
Security News BlackX UEFI Bootkit Step by Step: Why Patched Windows Still Fell Kaspersky says the BlackX UEFI bootkit beat Secure Boot on fully patched Windows PCs. See the attack steps, the APT41 link and the manual fix. 
Security News FortiSIEM 7.5.0 Flaw: Version Table, Port 27918 and Today’s Checks Fortinet lists FortiSIEM 7.5.0 for CVE-2026-106173; NVD lists more. See the version table, the 7.5.1 fix, the tcp 27918 workaround and what to check. 
Security News Operation Serengeti III: How INTERPOL’s Latest Sweep Compares With the Last Two INTERPOL's Operation Serengeti III led to 1,462 arrests in 21 countries. See how it compares with two earlier sweeps and what defenders can take from it. 
Security News Laravel Authentication Bypass: A Two-Line Fix in August, the Advisory in October Laravel's TokenGuard can accept a non-string token on MySQL and MariaDB. Follow the request, see the two-line fix and check your app before you update. 
Security News PHP2Shell Across Palo Alto Products: Status and Hotfix Dates Palo Alto says PHP2Shell affects PAN-OS and Panorama. See the hotfix dates for each release train and the management interface steps to take now. 
Security News Nextcloud Collabora CODE Server Flaw: The Five-Step Playbook (CVE-2026-110447) CISA added CVE-2026-110447 to KEV. Five steps to find the Collabora CODE app, update to 26.4.303, hunt for web shells and rotate secrets. 
Security News PHP Warns of a New RCE Path in Session Upload Progress (CVE-2026-115560) PHP has no patch yet for CVE-2026-115560, an unlikely RCE path in session upload progress. See who is affected and the setting to change now. 
Security News UpdraftCentral Keys Stolen: How the WordPress Backdoor Campaign Works Attackers used stolen UpdraftCentral keys to install backdoor plugins on WordPress sites. See what the developer says, what to check and what to remove. 
Security News Next.js Critical RCE Flaws: How to Check Your Patch Landed Two critical Next.js RCE vulnerabilities were fixed on 14 October. Check sharp, React packages and use cache code, plus what GitHub, X and dark web show. 
Security News Kaspersky: Lazarus Hides Malware Payloads With Post-Quantum Encryption in Operation FlashHole Kaspersky says Lazarus used ML-KEM-1024 in its LPEClient tool to protect payload delivery in Operation FlashHole. What it means and what to check. All 20 pages
About The Blog.
Last updated June 9, 2026-
Articles on ransomware, APT groups, the dark web, digital risk protection, fraud, sector analysis and VIP security, written for security teams.
-
New articles are added several times a month. The newest come first, and every article shows its publish date.
-
Use the topic chips above the list to open one topic, or type a word in the search box. Each topic has its own page.
-
Articles draw on public sources such as CISA advisories, MITRE ATT&CK and ENISA reports. Sources are listed at the end of an article when it cites them.
-
The site feed at brandefense.io/feed/ lists new posts. The email sign-up box is on the All Resources and Reports pages.
-
Brandefense is an AI-driven threat intelligence company. Its platform covers cyber threat intelligence, digital risk protection and external attack surface management. You can request a demo on your own domain from the Request A Demo page.
-
The count at the top of the blog page shows the current total, and each topic chip shows how many articles that topic holds. You can open all of them or pick one topic, such as APT Groups, Dark Web, Ransomware or Fraud. Each article shows its publish date.
-
The blog describes its articles as explained by the analysts who track threats. They cover threat actors, dark web activity, ransomware and digital risk. The newest articles appear first.
-
Yes. APT Groups is one of the topic chips above the list, and it opens only the articles on that topic. The Knowledge Hub also holds profiles of threat groups.
-
The surface web is the part of the internet that search engines list. The deep web is content that search engines do not list, such as pages behind a login. The dark web needs special software to reach. The blog has an article that explains the three layers in plain words.