Search

CVE-2026-104286: FortiMail Unauthenticated Arbitrary File Write Zero-Day Under Active Exploitation

A CVSS 9.8 FortiMail zero-day (CVE-2026-104286) lets an unauthenticated attacker write any file on the appliance through the IBE handler.…

Ransomware Trends Report | Q3 2026

The Brandefense Ransomware Trends Report Q3 2026 analyzes 2,898 confirmed ransomware incidents across 109 active threat groups, covering top operators,…

The Credential You Published on Purpose: How an Exposed GitLab Email Token Becomes Push Access to Main

A GitLab incoming email token published in a README never expires and works at account level. Learn how the attack…

Two NetScaler Zero-Days, One Wrong Assumption: Why Patching Does Not Close the Incident

Citrix fixed two actively exploited NetScaler zero-day flaws, but a patch does not remove an attacker already inside. Seven steps…

CVE-2026-76461: Cisco Secure Email Gateway SQL Injection Zero-Day Under Active Exploitation

A CVSS 9.8 SQL injection in Cisco Secure Email Gateway (CVE-2026-76461) lets an attacker gain root access with a single…

The Leak Site Got Breached: What ShinyHunters’ Takeover of Clop Means for the Companies Listed on It

ShinyHunters says it breached Clop's ransomware leak site and holds the keys to its Tor onion service. Here's what that…

Your Identity Programme Was Built for People. Non-Human Identity Is Now the Leading Way In.

New research shows compromised non-human identity now drives more breaches than phishing. See why service accounts, API keys, and AI…

The Phishing Came From Your Real Domain: What a Marketing Platform Breach Does to Brand Trust

An attacker breached a marketing platform and sent phishing emails from a hardware wallet maker's genuine domain to 347,000 subscribers.…

Passwordless Is Not Takeover Proof: Where Passkey Attacks Actually Land

Passkey attacks published this year do not break the cryptography. They target the sync fabric, the recovery path, and the…