The Cloud Atlas APT group modifies termsrv.dll to enable hidden concurrent RDP sessions, allowing stealth persistence, credential theft, and enterprise lateral movement across compromised environments.

The latest BIND 9 vulnerabilities expose DNS servers to remote denial of service attacks capable of crashing recursive resolvers and disrupting critical internet infrastructure worldwide.

The FortiClient code execution vulnerability CVE 2026 35616 allows unauthenticated attackers to compromise exposed EMS infrastructure through crafted requests, potentially leading to full enterprise endpoint management compromise.

The VS Code Remote SSH RCE vulnerability allows attackers to execute malicious code on developer workstations through compromised remote environments, exposing cloud infrastructure, source code repositories, and DevSecOps pipelines to supply chain compromise risks.

GREYVIBE hackers are using ChatGPT and Google Gemini to develop malware and generate phishing content in active cyberattacks targeting Ukraine. This AI-powered campaign signals a dangerous new phase in threat actor capability that every security team needs to understand and prepare for.

Famous Chollima, the North Korean state-sponsored threat group, has hidden malware inside a legitimate Packagist PHP package, targeting developers through fake job interviews and coding tasks. The Famous Chollima Packagist PHP supply chain attack uses blockchain-based command-and-control infrastructure to evade detection and steal cloud credentials, SSH keys, and CI/CD secrets from compromised developer machines.