Security News. From Our Analysts.

Security news from the Brandefense team: new malware, vulnerabilities, data breaches and threat actor activity, summarized for security professionals.

Dark glass media server tower with chained cracks with red neon lines, cover art for: Plex2Shell: Plex Media Server CVE chainSecurity News Plex2Shell: Four Plex Media Server CVEs Chained Into Remote Code Execution Plex2Shell chains four Plex Media Server CVEs into remote code execution. CISA lists all four as exploited. See the fixed version and what to check. Oct 23, 20267 Min Dark glass vault drawer of keys left ajar with red neon lines, cover art for: Railway Security Incident: Rotate Your Secrets NowSecurity News Railway Breach: What to Rotate, in What Order, and What to Check Railway says an unauthorized party may have read customer environment variables. This checklist covers which secrets to rotate, in what order, and which logs to review. Oct 23, 20268 Min Dark glass directory signpost with a cracked arm with red neon lines, cover art for: BIND 9 CVE-2026-94300: Fixed Versions and How to Check Your ExposureSecurity News BIND 9 CVE-2026-94300: Fixed Versions and How to Check Your Exposure ISC fixed a BIND 9 vulnerability in GSS-TSIG that can corrupt memory and may allow code execution. Fixed versions, who is exposed and a server check. Oct 22, 20266 Min Dark glass wax seal stamp with a red hairline crack, cover for eMudhra CA key compromise newsSecurity News eMudhra CA Key Compromise: What Python, uv and Container Teams Must Update Now Eight eMudhra CA keys were weak enough to recover. See what is true about the pip claim and the exact update and check list for Python,… Oct 22, 202611 Min Dark glass cracked hourglass with red neon lines, cover art for: GitLab CVE-2026-110264: Am I Affected and What to Do in the Next HourSecurity News GitLab CVE-2026-110264: Am I Affected and What to Do in the Next Hour GitLab CVE-2026-110264 (CVSS 10.0) allows unauthenticated code execution on self-managed servers. See affected versions, fixes and what to check. Oct 22, 202615 Min Dark glass key ring with one cracked key glowing red, cover art for the ConnectWise supply chain attack newsSecurity News Storm-0940 Used ARTEX Against ConnectWise: What Microsoft 365 Admins Should Check Microsoft ties Storm-0940 and the ARTEX AI framework to the ConnectWise supply chain attack. These are the Microsoft 365 checks, logs and indicators to review now. Oct 22, 20264 Min Dark glass parcel with a glowing red crack and a key slipping out, cover art for: LiteLLM 1.107.0 supply chain attackSecurity News LiteLLM 1.107.0 Supply Chain Attack: Timeline, Stolen Data and a Response Checklist LiteLLM 1.107.0 on PyPI and Docker carried a credential stealer on 21 October 2026. See the timeline, what it took and a checklist to pin and… Oct 21, 202610 Min Dark glass two glass hexagonal blocks stacked, a red crack running through both with red neon lines, cover art for: Next.js and Node.js Security Updates, October 2026: What to Patch FirstSecurity News Next.js and Node.js Security Updates, October 2026: What to Patch First Next.js 15.5.28 and 16.4.1 fix two critical remote code execution flaws. Node.js 26.12.1, 24.22.1 and 22.23.4 fix ten CVEs. See the patch table and checklist. Oct 21, 20266 Min Dark glass clipboard with a glowing red command line, cover art for: ClickFix attacks, Siemens Software Center, ROMULUS and ChromeSecurity News ClickFix This Week: Siemens Software Center Flaw, ROMULUS and Chrome’s Copied-Command Warning Siemens confirms exploitation of CVE-2026-110936 in ClickFix attacks, Forescout details ROMULUS and Chrome warns on copied commands. What to do now. Oct 21, 20264 Min Dark glass brass hook caught on a coiled ship rope with red neon lines, cover art for: Swallowtail (APT28) and HOOKEDGE: Attacks on Two NATO Countries and a Defender ChecklistSecurity News Swallowtail (APT28) and HOOKEDGE: Attacks on Two NATO Countries and a Defender Checklist Symantec and Recorded Future describe the HOOKEDGE backdoor used by APT28: Word macros, webhook.site and a hidden Edge window. Attack chain and checklist. Oct 21, 20265 Min Dark glass stack of square patch tiles, the upper tiles glowing red, cover art for: Oracle October 2026 Critical Patch Update: What to Patch FirstSecurity News Oracle October 2026 Critical Patch Update: What to Patch First Oracle's October 2026 Critical Patch Update has 1295 patches for 1209 CVEs. See which products to patch first, with CVSS scores and exposure. Oct 21, 20265 Min Glass castle tower with red neon circuit lines and a key hidden inside, cover art for BRONZE SANDCASTLE: Sandboxie DLL Sideloading Chain and Detection ChecksSecurity News BRONZE SANDCASTLE: Sandboxie DLL Sideloading Chain and Detection Checks Sophos CTU names BRONZE SANDCASTLE, a China-based group that sideloads Sandboxie DLLs. Read the infection chain, nine file pairs and a defender checklist. Oct 21, 20264 Min
All 20 pages
FAQ

About The Blog.

Last updated June 9, 2026
  • Articles on ransomware, APT groups, the dark web, digital risk protection, fraud, sector analysis and VIP security, written for security teams.

  • New articles are added several times a month. The newest come first, and every article shows its publish date.

  • Use the topic chips above the list to open one topic, or type a word in the search box. Each topic has its own page.

  • Articles draw on public sources such as CISA advisories, MITRE ATT&CK and ENISA reports. Sources are listed at the end of an article when it cites them.

  • The site feed at brandefense.io/feed/ lists new posts. The email sign-up box is on the All Resources and Reports pages.

  • Brandefense is an AI-driven threat intelligence company. Its platform covers cyber threat intelligence, digital risk protection and external attack surface management. You can request a demo on your own domain from the Request A Demo page.

  • The count at the top of the blog page shows the current total, and each topic chip shows how many articles that topic holds. You can open all of them or pick one topic, such as APT Groups, Dark Web, Ransomware or Fraud. Each article shows its publish date.

  • The blog describes its articles as explained by the analysts who track threats. They cover threat actors, dark web activity, ransomware and digital risk. The newest articles appear first.

  • Yes. APT Groups is one of the topic chips above the list, and it opens only the articles on that topic. The Knowledge Hub also holds profiles of threat groups.

  • The surface web is the part of the internet that search engines list. The deep web is content that search engines do not list, such as pages behind a login. The dark web needs special software to reach. The blog has an article that explains the three layers in plain words.