أبحاث تقنية، وملفات عن الجهات المهاجمة، وتحليلات معمّقة من الميدان.
Eye Security says it disabled an unauthenticated SYSTEM-level updater in the abandoned Time4Popcorn app on an estimated 2.5 to 3 million Windows PCs. CISA rates CVE-2026-30612 at 9.8.
Eye Security says it disabled an unauthenticated SYSTEM-level updater in the abandoned Time4Popcorn app on an estimated 2.5 to 3 million Windows PCs. CISA rates CVE-2026-30612 at 9.8.
A joint advisory says SafePay has compromised at least 600 organizations since August 2024, mostly through stolen credentials, VPN access and known edge-device flaws.
PHP will ship emergency fixes on October 21 at 14:00 UTC for CVE-2026-109618 and CVE-2026-109619 after an early leak. Scores are 9.2 per PHP and 10.0 per watchTowr.
CVE-2026-110447 (CVSS v4 9.2) is an unauthenticated command injection in Nextcloud's built-in Collabora CODE app, exploited since about September 10 per BleepingComputer.
CVE-2026-0322 (CVSS 8.6) lets an authenticated attacker run code as root via the PAN-OS management interface. CISA added it to the KEV catalog with a October 17 federal deadline.
The October 2026 update closes an exploited Mark of the Web bypass, CVE-2026-96951, plus two publicly disclosed flaws. BleepingComputer counts 1,411 fixes.
Cisco's NGOAM advisory covers three stack-based buffer overflows that let an unauthenticated attacker run code as root or crash a switch. Cisco's PSIRT reports no known exploitation.
CVE-2026-21589 lets unauthenticated attackers read specific files in the web root of Atlassian Data Center products. Patch, or pull exposed instances off the internet.
DIVD says an AI agent went from a hijacked session to root on its Zammad server in seconds on September 21. No patches existed at the time of reporting.
Symantec reports Warlock (Storm-2603) hit at least four organizations in two months, including a water utility and a telecom provider. One intrusion disabled security tools on 40+ hosts in about two hours and deployed ransomware via SYSVOL.
Dell fixed CVE-2026-63688 and CVE-2026-63692, both rated CVSS 10.0, plus CVE-2026-67269 (9.9) in Container Storage Modules. Unauthenticated attackers could gain admin control of the authorization service; no exploitation has been reported in the sources reviewed.
CVE-2026-100382 in the ExternalData extension gives unauthenticated attackers OS command execution. Public proof-of-concept code exists and compromised wikis are already serving web shells.
Bitget says suspected North Korean hackers drained about $351.6 million from hot and warm wallets by manipulating transaction data shown to its authorization process. Private keys were not stolen.
CERT Polska traced a two-bug SSH exploit chain, nicknamed MikroTrick, against internet-exposed MikroTik RouterOS devices back to September 2. CISA added the lead flaw, CVE-2026-67279, to its Known Exploited Vulnerabilities catalog and gave federal agencies until September 28 to patch.
CISA has added CVE-2026-87902, a critical unauthenticated file-inclusion flaw in WordPress core, to its Known Exploited Vulnerabilities catalog after attackers began weaponizing it within hours of the fix shipping.
تهديد مستمر متقدّم استهدف بنى مالية محصّنة في آسيا والمحيط الهادئ، والحمولة التي نفّذته.
A severe remote code execution flaw has been identified in Hugging Face's popular LeRobot platform. This unpatched vulnerability, rated critical, poses a significant risk to systems utilizing this open-source robotics framework.
Microsoft has issued urgent out-of-band updates to neutralize a critical privilege escalation flaw within ASP.NET Core. This vulnerability, CVE-2026-40372, poses a significant threat and demands immediate attention from all system administrators.
A sophisticated backdoor, dubbed FIRESTARTER, has successfully compromised a U.S. federal Cisco Firepower device, bypassing security patches. This incident highlights the persistent threat and advanced tactics employed by threat actors.
Microsoft has issued urgent patches for a high-severity flaw in ASP.NET Core, CVE-2026-40372, enabling attackers to elevate privileges. This out-of-band update is crucial for securing web applications.
A critical command injection vulnerability (CVE-2026-5760) in SGLang, rated CVSS 9.8, allows remote code execution through malicious GGUF model files. This threat demands immediate attention for all SGLang users.
A potent new Mirai variant, dubbed Nexcorium, is actively exploiting CVE-2024-3721 to hijack TBK DVRs and end-of-life TP-Link routers, expanding the reach of sophisticated DDoS botnets. This exploitation presents a significant threat to network infrastructure and data integrity.
Four critical vulnerabilities in Cisco's Identity Services and Webex Services have been patched, but the potential for attackers to execute arbitrary code and impersonate users demands immediate attention from all organizations relying on these platforms.
A critical remote code execution vulnerability, CVE-2025-0520, within the popular ShowDoc collaboration platform is currently being actively exploited in the wild, posing a significant threat to unpatched systems.
A critical zero-day flaw in Adobe Acrobat Reader, now designated CVE-2026-34621, is under active exploitation in the wild. Immediate patching is imperative to secure your digital perimeter.
A critical Remote Code Execution (RCE) vulnerability in the Marimo data science notebook was weaponized less than ten hours after its public disclosure. This rapid exploitation highlights the immediate threat posed by unpatched critical vulnerabilities in widely used open-source tools.
A sophisticated zero-day vulnerability in Adobe Reader has been actively exploited through malicious PDF documents since at least December 2025. This advanced threat bypasses conventional defenses, demanding immediate attention.
Advanced Persistent Threat 28 (APT28), a prominent Russian state-sponsored actor, has launched a new spear-phishing campaign utilizing a sophisticated, previously undocumented malware suite codenamed PRISMEX. This operation poses a significant threat to Ukraine and its NATO allies, demanding immediate attention.
Attackers used stolen credentials to reach a Nikkei development system on October 7. About 150,000 of the 1.83 million records held personal details, per BleepingComputer.
CISA's October 20 KEV update covers four chained Plex Media Server bugs used to drop miners and proxy malware, plus exploited flaws in Siemens Software Center and SiteGuard Server Edition. Federal deadlines start October 23.
Unit 42 updated its CVE-2026-0257 brief on October 19 with ransomware activity from Qilin and Inc. After the VPN foothold, one intrusion pivoted to vCenter and ESXi to dodge in-guest EDR.
Unit 42 detailed a fileless ARM64 implant on FortiGate firewalls, used after a FortiManager breach exposed configs and credentials for 500+ devices. CISA added the FortiOS flaw it relies on to KEV on October 16.
Mandiant says ARMORY CASTLE used CVE-2026-102764 (CVSS 9.3) to reach root on Remote Support appliances from late August. BeyondTrust disclosed it October 15.
Huntress saw exploitation of CVE-2026-105133 and CVE-2026-105134 from October 7, with five organizations hit by October 8. Patch status is unclear, so restrict access to the console now.
Researchers burned 32 zero-days on day one, hitting a Samsung Galaxy S26, Oracle's AI database, LiteLLM and OpenAI Codex. Vendors now have 90 days to patch.
On October 4, Citrix patched CVE-2026-88779, a memory buffer overflow in NetScaler SAML authentication. BleepingComputer reports it is already exploited, and the first DoS label may understate it.
A critical zero-day vulnerability in FortiMail, CVE-2026-104286, is actively being exploited, allowing unauthenticated attackers arbitrary file write access. CISA has added this to its KEV catalog, signaling immediate threat.
A crafted flow configuration can break out of the prompt template sandbox and run commands on self-hosted GitLab AI Gateways. Patches are out in 19.2.4, 19.3.2 and 19.4.1.
CVE-2026-104286 (CVSS 9.8) lets unauthenticated attackers write files to FortiMail appliances. CISA added it to KEV on October 1; federal deadline is October 4.
Apple fixed CVE-2026-86950, an out-of-bounds write in CoreGraphics reported by Meta, after an "extremely sophisticated" targeted attack. Updates 26.7.1 and 15.8.1 are out.
Critical unpatched vulnerabilities in Citrix NetScaler ADC and Gateway are being actively exploited in the wild. Immediate patching is paramount to mitigate significant risk.
Security firm watchTowr uncovered CVE-2026-88771 and CVE-2026-88772 in Citrix NetScaler ADC and Gateway while investigating already-compromised customer environments. Citrix shipped patches on September 27, but one flaw affects every default deployment and carries a CVSS 4.0 score of 9.5.
CISA has confirmed active exploitation of CVE-2026-65660, a SharePoint Server code injection flaw Microsoft first described as a low-severity spoofing bug. It's now rated 8.8 and lets authenticated attackers execute code on-premises.
Critical CVE-2026-42208 in LiteLLM is already being actively exploited, demanding immediate attention for developers and organizations utilizing this LLM orchestration tool. Swift action is paramount to mitigate potential data breaches and system compromises.
This week's cyber landscape reveals a concerning resurgence of aged attack vectors, coupled with novel exploitation of AI and pervasive supply chain compromises. Stay ahead of evolving threats with our tactical breakdown.
Microsoft has deployed critical out-of-band patches to neutralize CVE-2026-40372, a severe privilege escalation vulnerability within ASP.NET Core. This critical threat necessitates immediate action for all affected deployments.
The digital landscape is rife with recurring vulnerabilities, as evidenced by a colossal DeFi hack and novel threats targeting macOS and mobile infrastructure. A deeper dive into recent threat intelligence reveals persistent supply chain compromises and sophisticated attack vectors.
While the spotlight often shines on sophisticated exploits, the most effective entry point for adversaries remains alarmingly simple: compromised credentials. This tactical analysis delves into the pervasive threat of identity-based attacks and how organizations can fortify their digital perimeters against them.
A critical Remote Code Execution vulnerability, CVE-2025-0520, is currently being actively exploited in the wild targeting ShowDoc instances. Organizations running unpatched systems face significant data breach and compromise risks.
Threat actors are actively weaponizing three critical zero-day vulnerabilities within Microsoft Defender, two of which remain unpatched. This coordinated exploitation grants elevated privileges, posing a significant risk to enterprise security.
A critical authentication bypass in nginx-ui (CVE-2026-33032) is actively exploited, granting attackers full control over Nginx servers. This vulnerability poses an immediate and severe threat to web infrastructure.
This week's intelligence briefing highlights state-sponsored attacks on critical infrastructure and sophisticated new exploits targeting common file formats. Stay ahead of emerging cyber threats with our tactical analysis.
Fortinet has deployed critical out-of-band patches for a severe FortiClient EMS vulnerability (CVE-2026-35616) that has already seen active exploitation in the wild. This pre-authentication API access bypass poses a significant risk to unsecured systems.
Advanced persistent threats have leveraged a sophisticated zero-day vulnerability in Adobe Reader, actively exploiting malicious PDFs since December 2025. This high-stakes cyber operation demands immediate attention and robust defensive postures.
Advanced techniques are being employed to conceal malicious activities, demanding heightened vigilance from all digital stakeholders. Understanding these evolving obfuscation methods is paramount for robust cybersecurity defenses.
الـ Zero-Day هو لحظة الاختراق، أما Advanced Persistence فهو البقاء الدائم. في أجهزة IoT الحديثة لم يعد المهاجمون يكتفون بـ Malware يقيم في RAM، بل انتقلوا إلى Implants داخل طبقة Flash. ومن خلال التلاعب بتسلسل U-Boot أو UEFI يضمنون أن تفشل حتى إعادة ضبط المصنع في إزالة الإصابة، فلا يكتفي الجهاز بتشغيل كود خبيث، بل يتحول إلى بوابة دائمة وخفية داخل شبكتك الداخلية.
عرض كل التقارير المنشورة.
رصد الويب المظلم
كل تسريب تفهرسه الوحدة يغذّي الأرشيف نفسه الذي يبحث فيه فحص التسريبات، وعدده 12.4 مليار سجل.
آخر 12 أسبوعاً، قياسات تجريبية
| الأسبوع | التسريبات |
|---|---|
| W23 | 61 |
| W24 | 74 |
| W25 | 58 |
| W26 | 92 |
| W27 | 87 |
| W28 | 103 |
| W29 | 96 |
| W30 | 121 |
| W31 | 114 |
| W32 | 138 |
| W33 | 129 |
| W34 | 147 |
تصفّح حسب المجال
نشرة واحدة يومياً تغطّي الحملات النشطة، والأدوات الجديدة، وأي تغيّر في مشهد التهديدات.
جارٍ ربط الاشتراك
تم الاشتراك.
تصل أول نشرة إلى غداً الساعة 06:00 بتوقيت غرينتش.
تعذّر إتمام الاشتراك.
لم يُضَف. أعد المحاولة بعد قليل.
