blog

Attackers are exploiting CVE-2026-59310, a directory-traversal flaw in VMware vCenter, to deploy Babuk-derived ransomware. Internet-exposed management interfaces remain a top ransomware entry point. Our analysis vCenter is a crown jewel: own it and you…

An extortion group called Icarus reportedly broke into Klue’s systems using a credential issued back in 2022, exposing keys to customers’ cloud services for extortion. Our analysis This isn’t a zero-day story — it’s…

Microsoft’s August 2026 Patch Tuesday fixed hundreds of CVEs including CVE-2026-68820, an actively exploited privilege-escalation zero-day in the Windows WinSock driver. It’s the kind of bug attackers use to turn a single foothold into…

Microsoft researchers found a path in Semantic Kernel where a single prompt could become host-level remote code execution — code running on the machine hosting the AI agent. Our analysis This is the point…

Poland’s CERT Polska has observed active exploitation of CVE-2026-73570 in Zimbra Collaboration. Email platforms sit at the intersection of internet exposure and sensitive data. Our analysis A mail-server foothold hands attackers inboxes, credentials in…

Ransomware crews increasingly target identity systems, admin controls and backups to stop victims recovering. June 2026 alone saw 721 publicly disclosed victims. Our analysis The shift from “encrypt files” to “own identity and recovery”…