Threat intelligence
Emerging cyber security threats explained clearly
Practical vulnerability intelligence for defenders. Technical details, impacted versions, exploitation context and actionable guidance - all in one place.
Latest briefing
Critical PKI security alert · 28/10/2026
eMudhra Certificate Authority Incident: Eight Weak Intermediate CA Keys Expose Global Trust
eMudhra Certificate Authority Incident: Eight Weak Intermediate CA Keys Expose Global Trust
Eight eMudhra intermediate certificate authority (CA) certificates were found to contain cryptographically weak private keys that could be recovered from their corresponding public keys. Six intermediates were associated with TLS certificate issuance and two with code signing. An attacker possessing these private keys could potentially create fraudulent certificates to impersonate websites, intercept communications or sign malicious software. The affected intermediates have been revoked, and major browser and platform vendors have moved to distrust them.
CVE-2026-109618 & CVE-2026-109619: PHP2Shell-critical Unauthenticated RCE in PHP Runtime
CVE-2026-109618 involves out-of-memory handling and corrupted request state, while CVE-2026-109619 involves stale internal state retained after request cleanup. Successful exploitation can compromise web servers and expose application secrets, credentials, API keys and other sensitive data. Exploitation in the wild has been reported, although widespread successful exploitation has not been independently established. Upgrade affected PHP installations immediately and investigate potentially exposed systems for compromise.
CVE-2026-76519: Cisco Secure Email Gateway Arbitrary File Write
CVE-2026-76519 is a critical path-traversal vulnerability in Cisco Secure Email Gateway's Advanced Malware Protection (AMP) attachment handling. An unauthenticated remote attacker can send a crafted email attachment through a vulnerable gateway to write arbitrary files and potentially execute commands as root. Exploitation is active. Apply the fixed Content Scanner Tools package or upgrade immediately.
CVE-2026-32475: Elementor Pro Unauthenticated File Upload Leads to RCE via PHP Webshell
CVE-2026-32475 is a critical unauthenticated file-upload vulnerability in Elementor Pro. An attacker can upload arbitrary PHP, including webshells, and achieve remote code execution on vulnerable WordPress sites. Exploitation is active. Upgrade to 4.2.2 or later and investigate for malicious uploads.
CVE-2026-0322: PAN-OS Management Interface Authenticated RCE
CVE-2026-0322 is a high-severity remote code execution vulnerability in the PAN-OS management interface. An authenticated attacker with network access to the interface can execute arbitrary code with root privileges on a vulnerable firewall. Exploitation has been observed in the wild. Patch affected devices immediately and restrict management access to trusted internal hosts.
CVE-2026-21589: Atlassian Products Arbitrary File Access Exploited in Attacks
CVE-2026-21589 is a critical unauthenticated arbitrary file-access vulnerability affecting eight self-managed Atlassian products. Following public technical details and proof-of-concept release, exploitation has been reported; defenders should patch affected Data Center deployments, restrict exposure, and investigate logs for suspicious path-traversal requests.
CVE-2026-97229: GitLab CI/CD Regular Expression Compiler Remote Code Execution
GitLab has patched CVE-2026-97229, under certain conditions an unauthenticated attacker could exploit insufficient regular-expression validation by supplying a specially crafted regular expression in a CI/CD configuration to execute arbitrary code on vulnerable self-managed instances.
CVE-2026-102255: SonicWall SMA 1000 Critical SSRF Vulnerability Exploited in Attacks
Security researchers have reported exploitation attempts targeting CVE-2026-102255, a CVSS 10.0 pre-authentication SSRF flaw in SonicWall SMA 1000 appliances. The vulnerability may let remote unauthenticated attackers reach internal appliance functionality; organisations should urgently patch affected devices and investigate suspicious activity.
CVE-2026-86950: Apple Patches CoreGraphics Zero-Day
Apple has patched CVE-2026-86950, an out-of-bounds write vulnerability in CoreGraphics that may allow arbitrary code execution when processing a maliciously crafted file. Apple reports possible exploitation in extremely sophisticated attacks against specific targeted individuals. Organisations should prioritise patching affected Apple devices and verify update compliance across their managed estate.
No reports match. Try another search or category.