AI used in Aur0ra ransomware testing and execution
The GOLD OGRE threat group has used AI extensively to develop tools and to orchestrate and execute ransomware operations Categories: Threat Research Tags: AI, Ransomware, Aur0ra
Node2Shell (CVE-2026-111497) in active exploitation
Categories: Threat Research Tags: advisory, vulnerability, Node2Shell, Brotli
CVEs
CVE-2026-111497EPSS 100exploited
Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619)
Categories: Threat Research Tags: advisory, vulnerability, php
BRONZE SANDCASTLE deploys modified Meterpreter shells
<p>The China-based threat group uses DLL sideloading in these attacks</p> Categories: Threat Research Tags: BRONZE SANDCASTLE, Meterpreter, Sandboxie
ConnectWise Cloud Backup application abused in cross-tenant token sweep
<p>Automated sign-ins used the vendor's Entra application identity to request Microsoft Graph tokens across consenting tenants</p> Categories: Threat Research Tags: connectwise
Graph reconnaissance and ServiceNow user enumeration in a modern identity intrusion
No novelty required to be effective Categories: Threat Research, X-ops, Sophos SecOps Tags: incident response
building intent-based access control without reading minds
<p>This article was first published <a href="https://www.linkedin.com/pulse/building-intent-based-access-control-without-reading-minds-borges-dxg6e/" target="_self">on LinkedIn</a>.</p> Categories: AI Research, Threat Research Tags: AI, AI RESEARCH, Threat Research
Citrix NetScaler vulnerability (CVE-2026-88779) in active exploitation
Categories: Threat Research Tags: advisory, vulnerability, Citrix
CVEs
CVE-2026-88779EPSS 96exploitedCitrix
TerminalFix and Lorem Ipsum Loader enable covert tunneling
The activity is linked to a broader campaign that previously used a different delivery mechanism Categories: Threat Research Tags: TerminalFix, clickfix, Lorem Ipsum Loader
Citrix NetScaler vulnerabilities (CVE-2026-88771, CVE-2026-88772) in active exploitation
Categories: Threat Research Tags: advisory, vulnerability, Citrix
Kiteworks recommends server shutdown pending possible attack
Categories: Threat Research Tags: advisory, Kiteworks
September Patch Tuesday haul includes 973 CVEs
<p>Windows takes 718 fixes… but what if it was actually a slow month?</p> Categories: Threat Research Tags: Patch Tuesday, x-ops, Threat Research
ai research messageboards
<p>This article was first published <a href="https://www.linkedin.com/pulse/messageboards-all-you-need-nash-borges-iav6c" target="_blank">on LinkedIn.</a></p> Categories: AI Research, Threat Research Tags: AI, AI Cybersecurity, Threat Research
Cisco Secure Email Gateway vulnerability (CVE-2026-76461) in active exploitation
Categories: Threat Research Tags: advisory, vulnerability, Cisco
CVEs
CVE-2026-76461EPSS 98exploitedCisco
Devil’s advocate? Uncensored Luciferus AI service advertised underground
Uncensored refers to a lack of typical guardrails or ethical restrictions, lowering the technical barrier of entry into cybercrime Categories: Threat Research Tags: AI, Luciferus, underground