Cybersecurity / AI / Engineering / Threat Intelligence
Threat intelligence and what to do about it.
The threats that matter to your business, and the one thing to do about each of them, every morning.
Morning Threat Brief: Check Point gateways hacked to root with a wiper waiting, ransomware wipes a VMware estate with no hypervisor bug, the FBI disrupts a $400M fake video call scam, and AI agents break in under three hours
01
Do this Install the November Jumbo Hotfix now, starting with internet-facing Mobile Access portals.
02
Ransomware wiped an entire VMware estate in ten days without one hypervisor bug.
Do this Treat vCenter as a Tier 0 asset. Separate virtualization identities from enterprise administration.
03
The FBI seized the infrastructure behind a $400 million fake video call scam.
Do this If a video call asks you to install something or run a command, hang up and reach the person on a channel you already trust.
04
The FBI warns an AI pentesting framework is breaking into networks in under three hours.
Do this Make sure no AI agent console is reachable from the internet.
KEV catalog 1,781 entries, 2 new todayDue Mon Nov 16: CVE-2026-123039Due Mon Nov 16: CVE-2026-114713Due Wed Nov 18: Apple CVE-2024-27834Due Fri Nov 20: SonicWall CVE-2026-19868
Read the full briefCheck Point gateways hacked to root, ransomware wipes a VMware estate, the FBI disrupts a $400M fake video call scam, and AI agents break in under three hours
Attackers chained two PHP flaws to a brand new Check Point zero-day to take root on security gateways, then moved to VMware hosts and ran a data wiper.
6 min readHighRead the full brief →
Latest Intelligence
View All →Explore by Topic
Browse All Topics →28 entries
Morning Threat Brief
One brief every morning. The threats that matter, and what to do about them.
Browse the briefs →6 entries
AI Security
Risk, governance, and secure adoption of AI.
Browse AI Security →10 entries
Analysis
Longer takes on the stories behind the threats.
Browse Analysis →Writing
No pieces match that search.
2026-11-13Nvidia loses its founder CEO days before earnings. What changes for AI teamsAnalysis
2026-11-12Microsoft 365 Is Down for Tens of Thousands, and This Week's Security Patch Is Breaking Windows TooAnalysis
2026-10-26Anthropic Filed to Go Public. Here Is What That Means for the Businesses That Depend on Claude.Analysis
2026-10-25The Headlines Say the Internet Is Broken. Here Is What You Actually Need to Do.Analysis
2026-10-25Black October: A Disclosure Wave, Not a Single AttackAnalysis
2026-11-02Election Security: If a Message Claims Your Registration Is at Risk, Do Not Click ItAnalysis
2026-11-14Check Point gateways hacked to root, ransomware wipes a VMware estate, the FBI disrupts a $400M fake video call scam, and AI agents break in under three hoursThreat Brief
2026-11-13Attackers hijack ScreenConnect panels, a new N-central zero-day beats the patch, police seize StealC servers, and Citrix patches 10 critical flawsThreat Brief
2026-11-1230-plus N-central zero-days under attack, a new Windows flaw with no patch, Xen Orchestra logins bypassed, and Maersk confirms a breachThreat Brief
2026-11-11Microsoft patches an exploited Outlook zero-day, Barracuda flaws chain to root, SAP patches four perfect 10s, and Vanderbilt's attacker claims a million SSNsThreat Brief
2026-11-10Chrome patches its eighth exploited zero-day of 2026, Fireworks AI is breached again, CISA adds four exploited flaws, and Vanderbilt is hitThreat Brief
2026-11-09A cloud host tells every customer to rotate all keys, your AI coder may have posted your passwords on GitHub, a retailer breach hits 7.7 million, and a data broker's SSNs are claimed exposedThreat Brief
2026-11-07Your VPN's MFA can be bypassed, a runaway AI agent breached a company, crypto investigators lost every customer's credentials, and SSH has a no-password bugThreat Brief
2026-11-06Ransomware reached the hypervisor through a monitoring tool, a library system goes dark, freezers draw a federal warning, and DigiCert confirms a breachThreat Brief
2026-11-05An old Apple bug joins KEV as APT29 poisons websites, a perfect 10 Metabase flaw is still being hit, DreamHost confirms a two month breach, and WhiteArmor names UnileverThreat Brief
2026-11-04WordPress joins KEV with a Friday deadline, a Zyxel patch that did not patch, a perfect 10 Node-RED flaw under attack, and ransomware that may have run on autopilotThreat Brief
2026-11-03Ivanti patches the last two VPN zero-days, Synology boxes hit by C3RB3R, a security tool turned backdoor, and Google kills a 1.3 million box botnetThreat Brief
2026-11-02BeyondTrust probes widen, Trigger.dev secrets exposed, BTCPay hot wallets drained, and the Amadeus breach widensThreat Brief
2026-11-01FBI names North Korea in the $6.3 billion Binance theft, Chainalysis breached by agentic AI, and Northflank customers told to rotate everythingThreat Brief
2026-10-30GitLab 10.0 hits KEV, Cisco joins it, and a $6.3 billion theftThreat Brief
2026-10-29Linux kernel chain to root, VMware logging blind spot, and Cisco firewalls crashingThreat Brief
2026-10-28PolyShell and Brotli hit KEV, Apple patches 286 bugs, and a fake IT desk in TeamsThreat Brief
2026-10-27PHP2Shell hits KEV with an October 29 deadlineThreat Brief
2026-10-26FortiSIEM is now being exploited, PHP2Shell RCE confirmed, and an unverified J.B. Hunt claimThreat Brief
2026-10-2570,000 firewall credentials harvested from the edgeThreat Brief
2026-10-24CrowdStrike and NVIDIA take AI agent security into siliconAI Security
2026-10-24AI Agent Security Week: OpenAI just took its frontier models off the live internetAI Security
2026-10-24CISA confirms the Collabora Nextcloud flaw is being exploited, and a Qilin bank listing that proves nothing yetThreat Brief
2026-10-23VeloCloud zero-day turns read-only logins into superusers, Signal calls that never hang upThreat Brief
2026-10-22PHP2Shell exploited before the patch, LiteLLM poisoned on PyPIThreat Brief
2026-10-21SafePay at 600 victims, Qilin and INC hit GlobalProtectThreat Brief
2026-10-2011M Records Gone, 38 Ships on a Ransom ListThreat Brief
2026-10-19The 20-Year-Old Flaw in Every Apple DeviceThreat Brief
2026-10-17Proofpoint Is Buying Varonis for $6.3 Billion.Analysis
2026-10-17The Support Tool That Became a Skeleton KeyThreat Brief
2026-10-16A Phone Call, a Billion Phish, and a Fraud Ring DismantledThreat Brief
2026-10-15Two New Zero-Days Hit Your Edge, and You Have Three DaysThreat Brief
2026-10-14Three Ransomware Deadlines Hit Today. The Claims Are Unverified. Your Playbook Should Not Be.Analysis
2026-10-13Anthropic Took Its AI Evaluations Offline. The Problem Is Containment, Not Capability.AI Security
2026-10-12Don't Be Cruel to the Chatbot: What Anthropic's Policy Update Really Tells Security TeamsAI Security
2026-10-11Ransomware Comes for the Consultants: What the Deloitte Claim Tells DefendersAnalysis
2026-10-11Don't Make It Easy for Them: Cybersecurity Awareness Month 2026Analysis
2026-10-10Identity Controls for AI Agents: Treat Them Like Privileged AccountsAI Security
2026-10-10AI Is Practically Free Right Now. That Is Exactly Why the Labs Are Bleeding.AI Security