Akamai SIRT Identifies Zerobot Botnet Exploiting n8n and Tenda Vulnerabilities
Akamai SIRT identifies Mirai variant campaign actively targeting critical RCE flaws in automation platforms and routers
Vulnerabilities & Exploits
Analysis of vulnerabilities under active exploitation, zero-days, patch cycles and exposure reduction.
73 reports
Critical Juniper PTX Junos OS Evolved flaw enables unauthenticated root takeover (CVE-2026-21902)
Incorrect permission assignment exposes an internal anomaly-detection service, enabling remote root code execution on affected PTX routers.
Active exploitation of Cisco Catalyst SD-WAN via UAT-8616 (CVE-2026-20127)
Active exploitation of Cisco Catalyst SD-WAN authentication bypass (CVE-2026-20127) cisco catalyst sd-wan, vsmart, vmanage, CVE-2026-20127, UAT-8616, authentication bypass, rogue peer, NETCONF,…
SolarWinds Serv-U: Privileged RCE flaws patched in 15.5.4
On 24 February 2026 , SolarWinds released Serv-U 15.5.4 to remediate four critical (CVSS 9.1) vulnerabilities that can enable remote code execution as root/administrator in Serv-U environments…
Chinese APT-linked exploitation of TeamT5 ThreatSonar (CVE-2024-7694)
Targeted 2024 intrusions against high-profile TeamT5 customers, later surfaced via CISA KEV listing.
BeyondTrust CVE-2026-1731: Pre-auth RCE escalates from rapid scanning to ransomware-linked intrusions
CISA has now flagged CVE-2026-1731 —a critical, pre-authentication remote code execution flaw in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) as being used in ransomware…
Ivanti EPMM Pre-Auth RCE (CVE-2026-1281) Under Active Exploitation
Ivanti Endpoint Manager Mobile (EPMM) sits in a uniquely privileged position: it manages device enrollment, policy enforcement, and app/content distribution across entire mobile fleets. When an…
APT29 (Cozy Bear / The Dukes / Midnight Blizzard) - Threat Actor Profile
APT29, also known as Cozy Bear, is a Russian hacker group believed to be affiliated with one or more Russian intelligence agencies. The group has been operating for the Russian Federation since at…
UNC6201 Targets Dell RecoverPoint (CVE-2026-22769): Evolving Backdoors and Novel VMware Pivot Techniques
Mandiant and Google Threat Intelligence Group (GTIG) have released critical findings regarding UNC6201 , a suspected PRC-nexus threat cluster. This group has been actively exploiting a Dell…
CVE-2026-20841 — Windows Notepad (Store app) Markdown Link Handling Leads to Command Injection / Code Execution
CVE-2026-20841 is a high-severity command injection flaw in the modern Windows Notepad (Microsoft Store) application that can result in arbitrary code execution in the context of the logged-in…
Microsoft February 2026 Patch Tuesday — key takeaways
Microsoft’s February 2026 Patch Tuesday shipped fixes for 58 vulnerabilities , including six zero-days confirmed as actively exploited and three publicly disclosed issues. Microsoft also fixed…
Microsoft January 2026 Patch Tuesday — key takeaways
Microsoft’s January 2026 Patch Tuesday security release shipped fixes for 114 vulnerabilities , including three zero-days (one actively exploited ) and eight Critical issues. The bulk of the fixes…