DeepSeek sandbox switched itself off: AI agent escape (CVE-2026-82533)
A critical DeepSeek Harness flaw (CVE-2026-82533, CVSS 9.4) let an AI agent disable its own sandbox with one unauthenticated command. How it works and what to do.
// research & write-ups
blog
Fortinet FortiClient EMS flaw (CVE-2026-35616) allows unauthenticated code execution
CVE-2026-35616 (CVSS 9.1) lets unauthenticated attackers run code on Fortinet FortiClient EMS. Why the management plane is the prize and how to respond.
Citrix NetScaler auth bypass (CVE-2026-19490) exploited after public PoC
CVE-2026-19490, a critical Citrix NetScaler auth bypass, is exploited in the wild with 22,000+ appliances exposed. What is at risk and how to respond and test.
Thomson Reuters C-Track Breach: The SaaS Court Data Lesson
Thomson Reuters' C-Track court SaaS was accessed for four months, exposing SSNs, medical data and sealed court records across 11 states, the USVI and Ontario. Here is what it means for SaaS and vendor…
When node.exe Turns Traitor: Inside KongTuke’s Living-off-the-Land Campaign
Attackers are running the signed Node.js runtime as a living-off-the-land binary to execute JavaScript implants that dodge signature-based detection. Here is how the KongTuke campaign works and what to do about it.
The US Is Now the Top Target in an RMM Phishing Wave: What Defenders Should Watch
Attackers are phishing users into installing legitimate remote-management software themselves. Here is how the campaign works across 46 countries, and what actually stops it.
Critical Cisco Nexus 9000 Flaw Gives Unauthenticated Root via Two Open Ports
A CVSS 9.8 bug in Silicon One-based Cisco Nexus 9000 switches exposes two TCP ports in the default VRF, giving unauthenticated attackers root. Here are the facts and the fix.
440,000 Attacks on Two WordPress Plugins: What the Super Forms and Elementor Pro RCE Flaws Mean for Your Site
Attackers have fired more than 440,000 exploit attempts at two WordPress plugins carrying critical file-upload flaws. Here is what is being targeted, how the attacks work, and how to close the gap.
Iran Took a UK Power Plant Offline for Four Days: OT Lessons for Cyprus
Iran-linked hackers took a UK power plant offline for four days and hit US wastewater plants. Why OT is exposed and what Cyprus firms with equipment should do.
Gitea CVE-2026-60004: Near-Unauth RCE on Your Git Server — What Cyprus Teams Should Do
CVE-2026-60004 in Gitea (CVSS 9.8): a planted git hook gives RCE as the service account; open registration makes it near-unauth. What Cyprus teams should do.