News & Threat Intelligence

Vulnerabilities

The latest Vulnerabilities coverage, tracked and summarised by the analysts who run our SOC.

Updated daily · last update October 23, 2026

PHP2Shell Exploit Attempts Reach 22% of Swedish Organisations

PHP2Shell exploit attempts have reached 22% of organisations in Sweden since details of the two critical PHP flaws leaked on 20 October

October 23, 2026 Read more · 4 min

Vulnerabilities

PHP2Shell Forces Government Websites Offline Across Europe

Governments across Europe took websites offline on 21 October 2026 to shield them from PHP2Shell, two critical PHP flaws (CVE-2026-109618 and CVE-2026-109619)

October 22, 2026 Read more · 4 min

Vulnerabilities

Attackers Exploited Citrix NetScaler Zero-Days for Weeks Before Disclosure

Attackers exploited two zero-day vulnerabilities in Citrix NetScaler ADC and Gateway for at least three weeks before Citrix disclosed them on Sunday

October 1, 2026 Read more · 6 min

Vulnerabilities

Check Point Management Zero-Day Exploited as VPN Attacks Target Spark Firewalls

Check Point customers who installed the 9 September hotfixes closed the VPN flaw attackers began probing three days later. Management servers running those same builds…

September 25, 2026 Read more · 4 min

Vulnerabilities

Cisco Secure Email Gateway Zero-Day Gives Attackers Root From One Email

A single crafted email is enough to take root control of a Cisco Secure Email Gateway. Cisco disclosed CVE-2026-76461 on 14 September,

September 21, 2026 Read more · 5 min

Vulnerabilities

Dutch NCSC Expects Mass Exploitation of Two Critical Check Point VPN Flaws

The Netherlands' Nationaal Cyber Security Centrum told organisations on 10 September to patch two Check Point VPN vulnerabilities before anyone has published

September 14, 2026 Read more · 5 min

Vulnerabilities

Cisco Confirms Root-Access Flaw Already Exploited by Ransomware and State Hackers

Cisco has confirmed that a maximum-severity flaw in its Secure Firewall Management Center software is being exploited in real attacks, and the

September 10, 2026 Read more · 4 min

Vulnerabilities

N-able Patches Critical N-central RCE as Fourth Hotfix Lands in Five Weeks

N-able released a fourth emergency hotfix for its N-central platform over the weekend, closing a pre-authentication remote code execution flaw that an attacker can trigger…

September 7, 2026 Read more · 5 min

Vulnerabilities

SonicWall SMA 1000 Hit by a Third Exploited Zero-Day Chain Since December

Attackers are chaining two SonicWall SMA 1000 zero-days to execute code on enterprise VPN gateways without authenticating first. SonicWall confirmed the exploitation

September 3, 2026 Read more · 4 min

Vulnerabilities

PaperCut Attacks Escalate to Hands-On Intrusions as CISA Sets Deadline

Attackers exploiting two PaperCut NG/MF vulnerabilities have stopped scanning and started working inside the systems they have already compromised. WatchTowr, which has tracked exploitation since…

September 1, 2026 Read more · 5 min

Vulnerabilities

CERT-SE Urges Intrusion Checks After Citrix Patches Critical NetScaler Bypass

Citrix patched a critical authentication bypass in NetScaler ADC and NetScaler Gateway on 19 August 2026. CERT-SE published its own advisory the

August 26, 2026 Read more · 4 min

Vulnerabilities

Three Critical Splunk Flaws Expose Session Material to Unauthenticated Users

An unauthenticated attacker who can read the HTML source of a page that embeds a Splunk report can recover session material from

August 21, 2026 Read more · 6 min

Vulnerabilities

Critical Flaws in Belgian eID Software Exposed Millions of Bank and Government Users

Critical security vulnerabilities in Belgium's national eID middleware exposed users across eight of the country's ten largest banks and more than 60 government agencies to…

August 10, 2026 Read more · 2 min

Vulnerabilities

Swiss Government SharePoint Breach Hits 200 Accounts Through Unpatched Servers

Attackers breached the Swiss federal government's on-premises SharePoint servers and compromised approximately 200 user and technical accounts before the intrusion was detected. The Federal Office…

August 10, 2026 Read more · 4 min

Vulnerabilities

Fastjson 1.x Remote Code Execution Flaw Exploited With No Patch Available

There is no patch. That is the first thing to understand about the remote code execution vulnerability currently being exploited in Fastjson

July 28, 2026 Read more · 4 min

Vulnerabilities

ServiceNow Patches Critical RCE Flaw Already Exploited in the Wild

ServiceNow patched a critical remote code execution vulnerability on July 13, 2026. Attackers were exploiting it within days. The flaw, CVE-2026-6875, carries

July 22, 2026 Read more · 4 min

Vulnerabilities

Jscrambler NPM Package Compromised Across Five Versions, Rust Infostealer Installed on Upgrade

The official jscrambler npm package was compromised across at least five versions, beginning with 8.14.0. Any developer who installed or upgraded to

July 13, 2026 Read more · 5 min

Vulnerabilities

Citrix NetScaler Memory Flaw Under Active Exploitation by Four Threat Groups

A high-severity memory overread vulnerability in Citrix NetScaler is being actively exploited across multiple threat campaigns. Citrix disclosed CVE-2026-8451, a CVSS 8.8

July 7, 2026 Read more · 5 min

Vulnerabilities

Microsoft June 2026 Patch Tuesday Sets Record with 200 Vulnerabilities and Three Zero-Days

Three zero-days. Over 200 vulnerabilities. Microsoft's June 2026 Patch Tuesday is the largest single monthly update the company has ever released, and

June 15, 2026 Read more · 5 min

Vulnerabilities

Veeam Patches Critical RCE Flaw That Hands Backup Servers to Domain Users

Veeam has patched a critical remote code execution vulnerability in Backup & Replication 12.x that allows a low-privilege domain user to take over backup servers…

June 10, 2026 Read more · 4 min

Vulnerabilities

Two 7-Zip Flaws Are Being Exploited. Both Were Patched Months Ago

Two vulnerabilities in 7-Zip are being exploited in the wild, and both were fixed before the attacks started. CVE-2025-0411 was patched in November 2024. CVE-2025-11001…

May 26, 2026 Read more · 4 min

Vulnerabilities

Verizon DBIR: Vulnerability Exploitation Overtakes Credentials as Top Breach Vector

Vulnerability exploitation has surpassed stolen credentials as the leading cause of data breaches for the first time in the 19-year history of

May 21, 2026 Read more · 4 min

Vulnerabilities

Critical n8n Sandbox Escape Exposes 100,000 Automation Instances to Remote Takeover

A critical vulnerability in n8n's workflow automation platform allows authenticated attackers to break out of security sandboxes and execute arbitrary code on

May 20, 2026 Read more · 4 min

Vulnerabilities

Fortinet and Ivanti Close Critical Security Holes: Two Still Await AI-Driven Discovery

Fortinet and Ivanti patched 18 critical vulnerabilities on Tuesday, including two critical-severity flaws that allow unauthenticated remote code execution. Both companies say

May 14, 2026 Read more · 4 min

Vulnerabilities

Microsoft 365 Copilot Zero-Click Flaw Let Attackers Steal Data Via Email

Microsoft 365 Copilot contained a critical zero-click vulnerability that allowed attackers to exfiltrate sensitive company data simply by sending a malicious email. The flaw, discovered…

May 13, 2026 Read more · 4 min

Vulnerabilities

cPanel Zero-Day Exploited for Months Before Patch 44,000 Servers Hit

A critical authentication bypass vulnerability in cPanel has been under active exploitation since February, two months before the vendor issued a patch. CVE-2026-41940 carries a…

May 5, 2026 Read more · 4 min

Data Breaches

CISA Fast-Tracks Nine-Year-Old Linux Root Bug to Known Exploited List

CISA added CVE-2026-31431 to its Known Exploited Vulnerabilities catalogue on Friday, confirming that a nine-year-old Linux kernel flaw is being exploited in live attacks. The…

May 4, 2026 Read more · 4 min

Vulnerabilities

Single Git Push Could Have Compromised Millions of GitHub Repositories

A command injection flaw in GitHub's git push pipeline could have allowed attackers to execute arbitrary code on GitHub servers and access

April 30, 2026 Read more · 4 min

Vulnerabilities

Microsoft Defender Targeted by Three Zero-Days, Two Remain Unpatched

Microsoft Defender is under coordinated attack through three zero-day vulnerabilities that turn the security software into an attack vector. Huntress confirmed active

April 24, 2026 Read more · 4 min

Vulnerabilities

Adobe Reader Zero-Day Exploited for Weeks Before Patch Existed

Attackers have been inside Adobe Reader systems for four months before anyone caught them. The zero-day vulnerability, discovered by EXPMON researcher Haifei

April 9, 2026 Read more · 3 min

Behind the Feed

The Same Analysts Who Track These Stories Run Our SOC

This isn't a content mill. The threats we summarise here are the ones our Sweden-based analysts watch for across client environments, around the clock. When something breaks, our customers hear it from us first.

See how MDR works

3 min Average time to contain a confirmed threat

3 days To full 24/7 MDR coverage from contract

100+ Swedish organisations actively protected

24/7 SOC coverage, 365 days a year, in Sweden

Keep Going

Go Deeper

Articles

Cyber Intelligence from Our Analysts

Longer-form briefings and explainers, from incident breakdowns to practical NIS2 and Zero-Trust guidance.

All articles

Cybersecurity 101

Security Fundamentals, Explained Simply

Plain-language explainers on the core concepts, threats and frameworks behind modern security, for specialists and decision-makers alike.

Start with the basics

Vulnerabilities

PHP2Shell Exploit Attempts Reach 22% of Swedish Organisations

PHP2Shell Forces Government Websites Offline Across Europe

Attackers Exploited Citrix NetScaler Zero-Days for Weeks Before Disclosure

Check Point Management Zero-Day Exploited as VPN Attacks Target Spark Firewalls

Cisco Secure Email Gateway Zero-Day Gives Attackers Root From One Email

Dutch NCSC Expects Mass Exploitation of Two Critical Check Point VPN Flaws

Cisco Confirms Root-Access Flaw Already Exploited by Ransomware and State Hackers

N-able Patches Critical N-central RCE as Fourth Hotfix Lands in Five Weeks

SonicWall SMA 1000 Hit by a Third Exploited Zero-Day Chain Since December

PaperCut Attacks Escalate to Hands-On Intrusions as CISA Sets Deadline

CERT-SE Urges Intrusion Checks After Citrix Patches Critical NetScaler Bypass

Three Critical Splunk Flaws Expose Session Material to Unauthenticated Users

Critical Flaws in Belgian eID Software Exposed Millions of Bank and Government Users

Swiss Government SharePoint Breach Hits 200 Accounts Through Unpatched Servers

Fastjson 1.x Remote Code Execution Flaw Exploited With No Patch Available

ServiceNow Patches Critical RCE Flaw Already Exploited in the Wild

Jscrambler NPM Package Compromised Across Five Versions, Rust Infostealer Installed on Upgrade

Citrix NetScaler Memory Flaw Under Active Exploitation by Four Threat Groups

Microsoft June 2026 Patch Tuesday Sets Record with 200 Vulnerabilities and Three Zero-Days

Veeam Patches Critical RCE Flaw That Hands Backup Servers to Domain Users

Two 7-Zip Flaws Are Being Exploited. Both Were Patched Months Ago

Verizon DBIR: Vulnerability Exploitation Overtakes Credentials as Top Breach Vector

Critical n8n Sandbox Escape Exposes 100,000 Automation Instances to Remote Takeover

Fortinet and Ivanti Close Critical Security Holes: Two Still Await AI-Driven Discovery

Microsoft 365 Copilot Zero-Click Flaw Let Attackers Steal Data Via Email

cPanel Zero-Day Exploited for Months Before Patch 44,000 Servers Hit

CISA Fast-Tracks Nine-Year-Old Linux Root Bug to Known Exploited List

Single Git Push Could Have Compromised Millions of GitHub Repositories

Microsoft Defender Targeted by Three Zero-Days, Two Remain Unpatched

Adobe Reader Zero-Day Exploited for Weeks Before Patch Existed

The Same Analysts Who Track These Stories Run Our SOC

Go Deeper

Cyber Intelligence from Our Analysts

Security Fundamentals, Explained Simply

Get Cyber News in Your Inbox

Join the List