Briefings

Critical web-server flaws, third-party risk and ransomware aimed at recovery lead the week: PHP2Shell, the ConnectWise cloud backup compromise, Palo Alto GlobalProtect, ClickFix and SafePay.

Remote access systems, actively exploited vulnerabilities and disruptive incidents lead the week: SonicWall SMA, October Patch Tuesday zero-days, Ivanti Connect Secure, Ahold Delhaize and mass phishing.

Trusted platforms are becoming gateways for attackers: Citrix NetScaler, Cisco Catalyst SD-WAN Manager, Fortinet FortiMail, Zimbra, and an AI-enabled botnet hitting Docker.

Attackers are going after the systems that manage security and control networks: Check Point management servers, F5 BIG-IP, Arista VeloCloud, build environments and AI-enhanced Microsoft phishing.

Attackers are going after trusted management and security platforms: Cisco Secure Email Gateway, VMware vCenter, Cisco ISE, ConnectWise ScreenConnect and GitLab.

Attackers are going after the systems that keep organizations secure: Cisco Secure FMC, NetScaler and WatchGuard devices, plus the new BlueMoon exploit kit and an AI-driven PaperCut campaign.

Five threats worth watching this week: a PaperCut zero-day under active exploitation, Citrix NetScaler, Zimbra, a SharePoint RCE chain, and pressure on critical infrastructure and supply chains.

Five threats worth watching this week: Medusa ransomware, Windows privilege escalation, attacks on network infrastructure, risk in AI-generated code, and pressure on critical infrastructure and OT.