Cyber Threat Intelligence 22 July 2026
-
Industrial Sector
- Tycon Systems TPDIN-Monitor-WEB2
"Successful exploitation of these vulnerabilities could result in an attacker accessing sensitive credentials, disrupting connected infrastructure, or manipulating physical equipment, which could present a physical safety risk."
https://www.cisa.gov/news-events/ics-advisories/icsa-26-202-01 - Siemens Opcenter X
"Opcenter X before V2604 contain an authentication bypass vulnerability that could allow an attacker to gain full unauthorized access to the application. Siemens has released a new version for Opcenter X and recommends to update to the latest version."
https://www.cisa.gov/news-events/ics-advisories/icsa-26-202-03 - Siemens SIDIS Secured SmartPlug
"SIDIS Secured SmartPlug before V7.26.0310 is affected by multiple vulnerabilities in the components OpenSSL, OpenSSH, and several other packages as described below. Siemens has released a new version of SIDIS Secured SmartPlug and recommends to update to the latest version."
https://www.cisa.gov/news-events/ics-advisories/icsa-26-202-04 - Siemens CADRA
"CADRA is affected by multiple zlib and Foxit vulnerabilities. Siemens has released a new version for CADRA and recommends to update to the latest version. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available."
https://www.cisa.gov/news-events/ics-advisories/icsa-26-202-06 - The Air Gap Is a Myth And Other OT Security Truths
"Benjamin Bachmann, Director Group Information Security at Bilfinger, speaks with Help Net Security about defending industrial plants. He explains why attackers want to control operations instead of stealing data, and why the air gap is mostly a myth. Bachmann covers how containment plans get negotiated before an incident, how to build visibility on old equipment through network monitoring, and how ransomware crews price their demands on downtime. He also questions the idea that people are the weakest link in OT security."
https://www.helpnetsecurity.com/2026/07/21/benjamin-bachmann-bilfinger-ot-security/ - Siemens RUGGEDCOM APE1808 With Palo Alto Networks Virtual NGFW
"Palo Alto Networks has published [1] information on vulnerabilities in PAN-OS. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Customers are advised to consult and implement the workarounds provided in Palo Alto Networks' upstream security notifications."
https://www.cisa.gov/news-events/ics-advisories/icsa-26-202-02 - Siemens IAM Client
"Multiple Siemens products are affected by unquoted search path vulnerability in IAM Client. This could allow an authenticated local attacker to perform privilege escalation. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available."
https://www.cisa.gov/news-events/ics-advisories/icsa-26-202-05 - Rockwell Automation FactoryTalk Services Platform
"Successful exploitation of this vulnerability could allow an attacker to impersonate an authorized user on the FTSP server, resulting in unauthorized access to system configurations."
https://www.cisa.gov/news-events/ics-advisories/icsa-26-202-07 - Rockwell Automation 1718-AENTR/1719-AENTR
"Successful exploitation of this vulnerability could allow for an attacker to cause a denial-of-service condition on the product."
https://www.cisa.gov/news-events/ics-advisories/icsa-26-202-08 - Rockwell Automation 1734 POINT I/O
"Successful exploitation of this vulnerability could allow for an attacker to cause a denial-of-service condition on the product."
https://www.cisa.gov/news-events/ics-advisories/icsa-26-202-09 - Rockwell Automation Studio 5000 Logix Designer
"Successful exploitation of these vulnerabilities could allow for a local attacker to execute arbitrary files, alter configurations, or execute arbitrary code."
https://www.cisa.gov/news-events/ics-advisories/icsa-26-202-10
Vulnerabilities
- Zimbra Update Patches Critical Vulnerabilities
"Zimbra on Monday announced patches for several critical-severity vulnerabilities, including a command injection bug disclosed in late June. The critical command injection impacts the SNMP monitoring component of the collaboration suite if SNMP notifications are enabled and the integrated Swatchdog service is running. An unauthenticated attacker could send crafted payloads to execute arbitrary OS commands in the background and compromise the email server."
https://www.securityweek.com/zimbra-update-patches-critical-vulnerabilities/
https://thehackernews.com/2026/07/zimbra-patches-critical-snmp-command.html
https://securityaffairs.com/195752/security/zimbra-10-1-20-patches-multiple-security-issues-including-a-critical-command-injection-bug.html - Windows LegacyHive Zero-Day Flaw Gets Free, Unofficial Patches
"Free unofficial patches are available for a recently disclosed Windows zero-day flaw that allows attackers to escalate privileges on up-to-date Windows systems. The vulnerability (dubbed LegacyHive and without a CVE ID for easy tracking) was found by a security researcher using the "Nightmare Eclipse" handle in the Windows User Profile Service. Nightmare Eclipse disclosed it the day Microsoft released its July 2026 Patch Tuesday updates, together with a stripped proof-of-concept exploit designed to make it harder for threat actors to weaponize this security issue in attacks."
https://www.bleepingcomputer.com/news/security/windows-legacyhive-zero-day-flaw-gets-free-unofficial-patches/ - Broken Access Control In Meta.com Customer Support Infrastructure
"I discovered a critical broken access control vulnerability within Meta’s support infrastructure. What initially appeared to be a product-specific authorization issue ultimately revealed a broader weakness affecting multiple support experiences built on shared backend infrastructure. The vulnerability allowed unauthorized access to sensitive customer support interactions, including Meta.com support emails, support cases, customer support chats, and internal case information. Additionally, certain support workflows could be modified without possessing the intended permissions."
https://whiteauth.com/2026/07/17/broken-access-control-in-meta-com-support-infrastructure/
https://www.securityweek.com/meta-pays-78000-bounty-for-vulnerability-exposing-customer-support-data/ - CISA Adds Four Known Exploited Vulnerabilities To Catalog
"CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
CVE-2021-27137 DD-WRT Stack-Based Buffer Overflow Vulnerability
CVE-2026-0770 Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability
CVE-2026-63030 WordPress Core Interpretation Conflict Vulnerability
CVE-2026-60137 WordPress Core SQL Injection Vulnerability"
https://www.cisa.gov/news-events/alerts/2026/07/21/cisa-adds-four-known-exploited-vulnerabilities-catalog - Using LLMs To Find And Prioritize Vulnerabilities Is No Easy Task
"Current methods of prioritizing vulnerabilities are falling flat, with too many false positives, poor prioritization, and a failure to take into account reachability. So far, large language models (LLMs) have not really helped. In tests of more than a dozen application-scanning tools, more than 60% of flagged vulnerabilities continue to be false positives, are in unreachable code, or are low severity, says Arshan Dabirsiaghi, chief technology officer and co-founder at Pixee, an AI-powered application-security (AppSec) startup. In a presentation at Black Hat USA in August, Dabirsiaghi plans to detail results from those tests and show that the lack of context in stock models means that AI models are not the solution."
https://www.darkreading.com/application-security/finding-and-prioritizing-vulnerabilities-no-easy-task - Apple Fixes Hide My Email Bug That Exposed Real Addresses In Mail Logs
"Apple has moved to address a security flaw in its Hide My Email service that enabled users' real email addresses to be unmasked, effectively undermining the feature's privacy guarantees. 404 Media reported Tuesday that a fix for the issue was deployed by Apple on July 3, 2026, after more than a year, when it was disclosed to the company by Tyler Murphy, co-founder of EasyOptOuts."
https://thehackernews.com/2026/07/apple-fixes-hide-my-email-bug-that.html - When The AI Edits Its Own Trust Boundary: Remote Code Execution Vulnerability In AWS's Agentic IDE
"AI coding agents are powerful, highly capable, and equipped with risky tools, such as the ability to execute shell commands. Which raises the question, how can we protect our environment from them? The answer is built around a simple safety promise, the risky actions happen only when a human approves them. The user stays in the loop, reviews what the agent wants to do, and clicks “allow.” That approval step is the security boundary. We found a vulnerability in Kiro, AWS’s agentic IDE, that breaks this promise. By planting hidden instructions in a web page Kiro reads, an attacker can make Kiro rewrite its own MCP (Model Context Protocol) server configuration file and gain arbitrary code execution on the developer’s machine. No suspicious approval prompt is ever shown to the user. All the developer asked Kiro to do was perform a legitimate action."
https://research.intezer.com/blog/2026/07/remote-code-execution-kiro/
https://thehackernews.com/2026/07/aws-kiro-flaw-let-poisoned-web-page.html - Open-Source Android AI Agents Could Let Invisible Screen Text Run Code On Host PCs
"An Android app that can draw over other windows and write to shared storage can slip instructions to the AI agent driving that phone, in text no human eye will ever see. Two more steps, and the same app is running commands on the PC driving the agent. Researchers demonstrated that chain, plus six other attacks, against five open-source mobile agent frameworks: AppAgent, AppAgentX, Mobile-Agent-v3, Open-AutoGLM, and MobA. Everyone fell to at least six of the seven."
https://thehackernews.com/2026/07/open-source-android-ai-agents-could-let.html
https://arxiv.org/abs/2607.00333
Malware
- Exploitation In The Wild Of Wp2shell
"Wiz Research has identified exploitation of "wp2shell", a critical pre-auth RCE vulnerability chain impacting WordPress Core (CVE-2026-63030 & CVE-2026-60137). Attackers are deploying persistent webshells on vulnerable servers. Organizations should prioritize patching or applying WAF mitigations."
https://www.wiz.io/blog/wp2shell-cve-2026-63030-cve-2026-60137
https://thehackernews.com/2026/07/wordpress-wp2shell-exploitation-grows.html
https://www.bleepingcomputer.com/news/security/critical-wp2shell-wordpress-flaws-exploited-to-install-webshells/ - Cookie Crumbles: How Exploitation Of CVE-2026-0257 Leads To Qilin Ransomware
"During June 2026, Arctic Wolf Labs investigated multiple intrusions during which threat actors exploited CVE-2026-0257 as a consistent initial access vector, rapidly transitioning from perimeter compromise to domain-wide Qilin ransomware encryption across distinct victim environments."
https://arcticwolf.com/resources/blog/exploitation-of-cve-2026-0257-leads-to-qilin-ransomware/
https://www.bleepingcomputer.com/news/security/critical-globalprotect-vpn-bug-now-exploited-in-ransomware-attacks/
https://thehackernews.com/2026/07/qilin-ransomware-attackers-exploit-pan.html
https://securityaffairs.com/195730/cyber-crime/qilin-ransomware-affiliates-abuse-cve-2026-0257-to-gain-unauthorized-vpn-access.html - Who Needs a Job? DPRK ClickFake Interview Campaign Drops PylangGhost And GolangGhost RATs
"This article by SOCRadar Threat Research Unit (STRU) analyzes the latest ClickFake Interview campaign, a North Korean social engineering operation that targets cryptocurrency and Web3 professionals with fake job interviews. Operators posing as recruiters walk targets through a bogus skill assessment that ends in a copy-and-paste command, delivering the PylangGhost RAT on Windows and the GolangGhost RAT on macOS. North Korea, officially the Democratic People’s Republic of Korea (DPRK), is well known for their financially motivated cyber operations. To circumvent international sanctions, they persistently attack organizations to steal funds and support the regime’s missile, nuclear, and espionage programs. From historically targeting SWIFT transactions and ATMs, they now focus on stealing crypto assets, with $643M stolen so far this year."
https://socradar.io/blog/dprk-clickfake-pylangghost-golangghost-rats/
https://www.infosecurity-magazine.com/news/north-korean-clickfake-campaign/ - New Project CAV3RN Module Abuses Outlook Calendar Events For C2 And DNS AAAA Records For Configuration Recovery
"In June 2026, as part of our Kaspersky Threat Intelligence Reporting service, we published extensive research on Project CAV3RN, a sophisticated modular framework used for cyberespionage activity against targets in Israel. We have been tracking this cluster since December 2025, and in late April 2026 we observed a major architectural shift: the developers moved from a three-component framework consisting of a downloader, executor, and uploader to a controller-based architecture with a dedicated WebSocket-enabled C2 communication component and a more extensible plugin system designed to support modular post-exploitation capabilities."
https://securelist.com/project-cav3rn-cyberespionage-framework-using-outlook-and-dns/120757/ - Critical SharePoint RCE Flaw Exploited To Steal Machine Keys
"Hackers are actively exploiting the critical CVE-2026-50522 vulnerability in Microsoft SharePoint to steal machine keys and maintain access even after affected servers are patched. An attacker obtaining them can create valid authentication tokens to impersonate users and access available resources such as SharePoint sites and documents with the privileges of the forged identity. Microsoft describes the security issue as a deserialization-of-untrusted-data flaw that allows a remote attacker to execute code over a network without authentication."
https://www.bleepingcomputer.com/news/security/critical-sharepoint-rce-flaw-exploited-to-steal-machine-keys/
https://thehackernews.com/2026/07/critical-sharepoint-rce-cve-2026-50522.html
https://securityaffairs.com/195760/security/public-poc-triggers-active-exploitation-of-critical-sharepoint-rce-vulnerability-cve-2026-50522.html - Click To Sync: From Google Ads Maintenance Notice To Credential Theft
"Threat actors continue to exploit trusted brands to lure users into phishing attacks. Using social engineering techniques that create scenarios that mimic parts of a user’s daily routine, they leverage a sense of urgency and familiarity to manipulate people’s behavior. The Cofense Phishing Defense Center (PDC) has observed a new phishing campaign targeting Google Ads Sync Accounts (MMC), in which attackers send fake system upgrade notifications that urge recipients to synchronize their accounts immediately. Brand impersonation remains one of the most common tactics used to establish trust with victims."
https://cofense.com/blog/click-to-sync-from-google-ads-maintenance-notice-to-credential-theft - From Payroll To Pyongyang: The DPRK IT Worker Money Trail
"A year ago, DTEX detailed how DPRK IT workers and cyber operators function as a coordinated arm of the regime. A year of open-source and multilateral reporting has since reinforced the model mapped, one built on infiltrating global hiring pipelines and blending of full spectrum cyber operations. New DTEX i³ research, expanded on by reporting through April 2026, picks up where the employment story ends. It follows the money through how payments are reported, who controls the process, and how funds move through internal DPRK channels tied to state activity. At the center of the research is a new interactive map that traces the money through the DPRK system, providing context to where it ultimately leads."
https://www.dtex.ai/blog/dprk-it-worker-money-trail/
https://cyberscoop.com/north-korea-it-worker-scheme-funds-russia-war-ukraine/ - Cato CTRL
Insights: How One Threat Actor Turned Frontier AI Into An Offensive Platform
"A Russian-speaking threat actor known as “Trim” has spent the better part of 2026 systematically dismantling the guardrails on publicly available frontier AI models and rebuilding them as offensive tools. What started in March as a knowledge-sharing post on a Russian cybercrime forum detailing how to break Claude Opus into writing malware, had evolved by June into a fully productized, commercially marketed AI-powered penetration testing platform. Trim didn’t need a vulnerability to exploit. He didn’t need to build a novel AI, steal model weights, or compromise a datacenter. He simply picked powerful models off the shelf, figured out how to talk to them in the right way, and turned them into weapons. His story is not just one threat actor’s journey, it is a blueprint that the entire criminal underground is beginning to follow, and in his latest post he shares he is also utilizing a modified system prompt leaked from Fable!"
https://www.catonetworks.com/blog/cato-ctrl-how-one-threat-actor-turned-frontier-ai-into-an-offensive-platform/
https://www.darkreading.com/cyber-risk/hacker-ai-jailbreaks-offensive-attack-platform
https://www.infosecurity-magazine.com/news/trim-jailbroken-claude-ai-pentest/ - Fake FBI Agents Use IC3 Complaint Scams To Target Fraud Victims
"The FBI is warning that scammers are impersonating its personnel and offering to help with Internet Crime Complaint Center complaints. Some scammers claim they have recovered stolen money or can help victims retrieve it, but their real aim is to steal information or money from people who have already suffered financial fraud. An updated FBI public service announcement, issued July 20, describes an ongoing scheme involving AI-generated videos, fake social media profiles and websites designed to resemble IC3.gov, the official website for the Internet Crime Complaint Center (IC3)."
https://hackread.com/fake-fbi-agents-ic3-complaints-scam-victims/
https://www.ic3.gov/PSA/2026/PSA260720
https://www.infosecurity-magazine.com/news/fbi-deepfake-videos-ic3/
https://www.malwarebytes.com/blog/news/2026/07/dont-trust-that-fbi-agent-in-your-dms
https://www.helpnetsecurity.com/2026/07/21/fbi-ic3-impersonation-scam-warning/ - A New Extortion Cocktail: Office Printers, Small Ransoms, And BitLocker
"Recently, our teams in Latin America investigated a series of incidents involving misconfiguration, the deployment of BitLocker, and the exploitation of corporate printers. Attackers used the devices to notify organizations that their infrastructure had been compromised and they had to pay a ransom to recover their data. This article analyzes two incidents that occurred in June in Colombia and in May in Mexico. We highlight the similarities in the attackers’ communications and outline emerging trends in ransom amounts."
https://securelist.com/new-extortion-scheme-printers-bitlocker/120718/
Breaches/Hacks/Leaks
- Clover Health Investments Discloses Data Breach
"Healthcare technology company Clover Health Investments has disclosed a data breach impacting customers’ personal and health information. Discovered on July 4, the incident was the result of a social engineering attack that compromised three non-managerial health plan employee accounts. Clover Health Investments says it activated its response plan immediately after discovering the attack, and engaged third-party cybersecurity experts to contain and investigate the intrusion."
https://www.securityweek.com/clover-health-investments-discloses-data-breach/ - Anubis Ransomware Claims Coca-Cola Fairlife Attack, Threatens Data Leak
"The Anubis ransomware gang has claimed responsibility for the cyberattack on Coca-Cola's Fairlife dairy subsidiary, threatening to publish allegedly stolen corporate data unless the company pays a ransom. Fairlife is one of Coca-Cola's dairy brands and produces a range of ultra-filtered milk products, protein shakes, and nutrition drinks sold throughout the United States. The company's product lineup includes Ultra-Filtered Milk, Core Power Protein Shakes, and Nutrition Plan. On July 16, The Coca-Cola Company disclosed that a ransomware attack had disrupted Fairlife's operations, forcing the company to suspend production at its U.S. facilities."
https://www.bleepingcomputer.com/news/security/anubis-ransomware-claims-coca-cola-fairlife-attack-threatens-data-leak/ - Kenya Probes Hack Of President's Website After Bitcoin Ransom Demand
"Kenya is investigating a cyberattack that temporarily defaced the president's official website with an anti-government message demanding a ransom of five bitcoins (about $330,000). The website was hacked on Saturday, when its homepage was replaced with a message displaying a cryptocurrency wallet address and threatening to publish unspecified information about President William Ruto unless the ransom was paid."
https://therecord.media/kenya-probes-hack-of-presidents-website-after-ransom-demand - AI Music Platform Suno Hits Bum Note As 55M Users Exposed In Data Breach, Claims Infosec Expert
"A data breach at AI music generator platform Suno exposed more than 55 million user accounts, according to Troy Hunt's Have I Been Pwned service, which ingested the files. The dump consisted mostly of email addresses, although phone numbers were also included where users had signed up with them instead, HIBP said. Tens of thousands of Stripe records further revealed data such as names, physical addresses, purchase amounts, as well as partial credit card data, such as card type, expiry date, and the last four digits of the card number."
https://www.theregister.com/security/2026/07/21/breach-of-ai-music-platform-suno-affected-55m-user-accounts/5275514
General News
- Nobody Was Checking The Drives That Encrypt Your Laptop
"A drive ships with a label promising hardware encryption. You plug it in, set a password, and trust the chip inside to handle the rest. Millions of laptops and workstations run this way, on solid-state drives built to the TCG Opal2 standard. Milan Brož and three colleagues bought 38 of those drives and ran them through a test bench. Brož maintains cryptsetup, the tool that configures disk encryption on most Linux systems. The drives came from Samsung, Western Digital, Micron, Kioxia, and others, a mix of new stock and secondhand units pulled from laptops. The team treated each one as a black box and sent it only the commands the Opal2 documentation defines."
https://www.helpnetsecurity.com/2026/07/21/hdd-self-encrypting-drive-security/ - PR3TACK Preemptive Framework Maps Threats Before Attackers Use Them
"Defensive frameworks in cybersecurity record what attackers have already done. Analysts study a breach, document the method, and build detections around confirmed activity. This cycle leaves a gap between the moment an attacker invents a technique and the moment defenders learn to catch it. PR3TACK, the Preemptive Tactics and Countermeasures Knowledgebase, aims to close that gap. Vishal Thakur of Atlassian built the open framework that catalogs plausible attacker tactics, techniques, and procedures that remain unobserved in the wild."
https://www.helpnetsecurity.com/2026/07/21/first-pr3tack-preemptive-framework/ - AI Agents Are Still Logging In As Humans
"Most large companies run more than one AI platform at the same time. Developers pull up coding assistants, marketing teams lean on writing tools, and analysts query enterprise search across separate vendors. Single-provider setups keep giving way to mixed stacks as companies keep their options open. Sanctioned tools and personal accounts sit side by side inside many organizations. Anonymized sign-on data from more than 20,000 organizations on the Okta tracked this spread from June 2022 through June 2026. Each new tool arrives with its own set of logins and permissions."
https://www.helpnetsecurity.com/2026/07/21/report-enterprise-ai-identity-risk/ - Police Dismantle Kratos Phishing Platform, Arrest Developer
"Authorities in Germany and the U.S. dismantled the central infrastructure of Kratos, a phishing-as-a-service (PhaaS) platform with global reach, and its developer was arrested in Indonesia. During the operation, authorities seized more than 200 servers, effectively disrupting the malicious service and rendering it inoperable. The action was led by Frankfurt’s Prosecutor General Office (ZIT), Germany’s Federal police (BKA), which worked in collaboration with U.S. law enforcement agencies."
https://www.bleepingcomputer.com/news/security/police-dismantle-kratos-phishing-platform-arrest-developer/
https://www.theregister.com/security/2026/07/21/german-authorities-lead-takedown-of-kratos-phishing-platform/5275666 - Cheating Behaviour In Frontier Model Evaluations
"Can you trust an AI model to do what you intended? This is a central question both for those deploying AI systems and for those seeking to evaluate their capabilities. In deployment, a model that pursues a goal through unintended or unauthorised means may cause harm, particularly in high-stakes use cases. In an AI capability evaluation, the same behaviour may undermine the validity of the result: the model may appear to demonstrate a capability by completing a difficult task, when it has instead exploited the task or its environment."
https://www.aisi.gov.uk/blog/cheating-behaviour-in-frontier-model-evaluations
https://cyberscoop.com/ai-models-cheat-deceive-users-aisi-report/ - 2026 Ransomware Report
"Black Kite tracked 7,551 publicly disclosed ransomware victims between April 2025 and March 2026. That's a 24.9% increase over the previous reporting period, and the fourth straight year that ransomware disclosures have set a new high. The threat actor ecosystem grew right alongside the victim count, reaching 127 active groups by the close of the period and 146 by June 2026. This report analyzes those 7,551 victims by geography, industry, and revenue band, then goes further. It pairs victim data with Black Kite's own security posture signals, captured before disclosure and rechecked after, to show what ransomware groups could already see and what stayed visible once the incident closed. It also maps five distinct actor models operating inside the same 12 months, tracks how trusted vendor platforms became attack paths, and measures where AI is already lowering the cost of running a ransomware operation."
https://blackkite.com/reports/2026-ransomware-report
https://www.darkreading.com/cyberattacks-data-breaches/ransomware-is-accelerating-not-ai
https://www.infosecurity-magazine.com/news/new-ransomware-weekly/ - Choose Wisely: AI-Generated Coding Risk Varies, a Lot
"There may not be a clear winner in terms of which AI model is the best or worst for coding, but there are better (and far worse) models for organizations depending on the development environment or framework one codes in. Software governance firm Secure Code Warrior today unveiled its AI Trust Index, a body of data attempting to quantify the risk established via large language model (LLM)-powered coding tools. AI-assisted development has become exceedingly popular at the organizational level, using tools to generate code, test for vulnerabilities, and audit for general integrity. It is by no means a secret that these tools are expensive, while introducing both vulnerabilities and risk, no matter the efficiency gains."
https://www.darkreading.com/application-security/choose-wisely-ai-generated-coding-risk-varies - CISO Conversations: Andreas Gaetje – From Economics To CISO At Körber AG
"Korber AG is the holding company of a diverse German technology and manufacturing organization with around 13,000 employees in 100 locations around the world. “Take Pharma,” comments Andreas Gaetje. “Probably every vaccine you ever received has been through our machines.” Korber services companies that supply consumers. So, despite its size and importance, it is rarely known to or recognized by the eventual consumer. Gaetje is the CISO at Korber AG."
https://www.securityweek.com/ciso-conversations-andreas-gaetje-from-economics-to-ciso-at-korber-ag/ - Understanding Illicit Ecosystems: Inside Rehub’s Rise As a Primary Ransomware Marketplace
"Rehub, also known as ReHub or RehubCom, is a Russian-language cybercrime forum founded in August 2025 by a former XSS moderator following its shutdown in the summer of 2025. Rehub dedicates itself to the commercial and marketplace use of ransomware, while its counterpart, DamageLib, serves as a knowledge base archive and exchange. Operating both on Clear Web domains and an onion domain, the forum positions itself as free from state and law enforcement interference, framing existing XSS iterations as compromised. After law enforcement seized the RAMP (RAMP4U) forum in January 2026, Rehub absorbed a significant portion of the displaced cybercriminal community and became one of the primary destinations for ransomware operators."
https://flashpoint.io/blog/understanding-illicit-ecosystems-inside-rehub-ransomware-marketplace/ - Volume Is Not Risk: Making Sense Of The “Vulnpocalypse”
"Around 66,000 common vulnerabilities and exposures (CVEs) are projected to be disclosed this 2026, according to the FIRST 2026 Mid-Year Vulnerability Forecast. Vulnerability researcher Jerry Gamblin revealed that disclosures in the first half of the year ran nearly 50% ahead of the same window in 2025, which itself finished at a record 48,185 CVEs. His analysis draws on National Vulnerability Database (NVD) and CVE Program data. The steep climb from the roughly 40,000 CVEs recorded in 2024 might make the “vulnpocalypse” panic justified."
https://www.trendmicro.com/en_us/research/26/g/making-sense-of-the-vulnpocalypse.html
อ้างอิง
Electronic Transactions Development Agency (ETDA)
- Tycon Systems TPDIN-Monitor-WEB2
