Public intelligence brief
Snapshot for · every conclusion links to the underlying coverage.
AI brief Attackers increasingly exploit zero-days before disclosure, targeting critical infrastructure and software supply chains. Active exploitation spans SonicWall, Cisco, Check Point, TeamCity, and WordPress. Water systems face coordinated attacks, while extortion and AI supply chain risks persist.
Ranked by coverage, source breadth, operational urgency, and freshness.
North Korea's Lazarus group exploited Windows zero-day CVE-2026-68820 in fake job offers targeting defense firms. Microsoft's August 2026 Patch Tuesday fixed the flaw among 400+ vulnerabilities, including other disclosed zero-days.
Cisco warns CVE-2026-20349, a high-severity unauthenticated DoS flaw in ASA and FTD firewall software, is being actively exploited to remotely crash devices. Patches are available.
Threat actors are exploiting Microsoft SharePoint authentication bypass CVE-2026-55040 (CVSS 9.1) after public PoC release. Researchers also disclosed an AI-assisted exploit chain achieving unauthenticated RCE, affecting SharePoint servers.
SAP patched CVE-2026-58231, a CVSS 10.0 improper authorization flaw in Commerce Cloud's Data Hub Adapter allowing unauthenticated remote code execution; Defused reports active exploitation within three days of the fix.
A new White House memo directs the National Coordination Center to let private security firms apply for approval to conduct offensive hack-back operations against foreign cybercrime organizations, expanding the role of the private sector in U.S. cyber defense.
Chaotic Eclipse released a PoC for ShieldBreak, a Microsoft Defender zero-day bypassing the CVE-2026-50656 patch to achieve SYSTEM-level code execution. The vulnerability highlights an incomplete fix in Defender for Windows.