Threat Wire
BleepingComputer [Critical] FBI links $6.3 billion Binance crypto heist to North Korean hackers BleepingComputer [Critical] Alpine Linux rebuilds GitLab after attempted RCE attack CVE-2026-118539 [Critical] Security Affairs newsletter Round 602 by Pierluigi Paganini – INTERNATIONAL EDITION CVE-2026-58882 [Critical] SMS of Death: Android under attack, an invisible SMS can block calls and emergency services The Hacker News [Critical] CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key The Hacker News [Critical] FBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto Heist CVE-2026-111357 [Critical] U.S. CISA adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog BleepingComputer [Critical] Northflank security breach leads to abuse of customers' AI API keys BleepingComputer [Critical] FBI links $6.3 billion Binance crypto heist to North Korean hackers BleepingComputer [Critical] Alpine Linux rebuilds GitLab after attempted RCE attack CVE-2026-118539 [Critical] Security Affairs newsletter Round 602 by Pierluigi Paganini – INTERNATIONAL EDITION CVE-2026-58882 [Critical] SMS of Death: Android under attack, an invisible SMS can block calls and emergency services The Hacker News [Critical] CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key The Hacker News [Critical] FBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto Heist CVE-2026-111357 [Critical] U.S. CISA adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog BleepingComputer [Critical] Northflank security breach leads to abuse of customers' AI API keys

CyberWatch Newsroom Live Intel

Continuous enterprise threat intelligence tracking active in-the-wild zero-days (CISA KEV), Microsoft Windows KB cumulative updates, MSRC security advisories, and CVE remediation.

Last Checked: Nov 2, 2026 - 02:28:59 UTC (Hourly Auto-Sync Active)
Newsfeed (/feed) RSS Feed JSON API
All Security Bulletins 5,807 Active Zero-Days (KEV) 608 Microsoft Patch KBs 849 MSRC Live Wire 1,922 CISA Advisories 157 Threat Intel 2,629
Showing 24 of 82 advisories
Page 2 of 4
Orphaned VBA Projects Inside DWG Files, (Wed, Oct 14th) Moderate SANS Internet Storm Center
2026-10-14 SANS Internet Storm Center

Orphaned VBA Projects Inside DWG Files, (Wed, Oct 14th)

Years ago I wrote diary entries about VBA code stored inside AutoCAD drawing files (.dwg).

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Operational Threat Radar
Advisory
October 2026 Microsoft Patch Tuesday, (Tue, Oct 13th) Moderate SANS Internet Storm Center
2026-10-13 SANS Internet Storm Center

October 2026 Microsoft Patch Tuesday, (Tue, Oct 13th)

Microsoft today released patches for 1,417 vulnerabilities. 76 of these vulnerabilities are rated critical, with 7 critical vulnerabiilties requiring no customer actions. One vulnerability was disclosed before today's patch Tuesday, and one is already exploited.

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Operational Threat Radar
Advisory
Why TLP should not replace your internal information classification, (Sat, Oct 10th) Moderate SANS Internet Storm Center
2026-10-10 SANS Internet Storm Center

Why TLP should not replace your internal information classification, (Sat, Oct 10th)

The Traffic Light Protocol (TLP)[1], which is now in its second incarnation, is a wonderful standard that enables one to easily communicate whether information may be shared further (and if so, how far).

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Operational Threat Radar
Advisory
Reconstructing AI Agent Activity: Two New Scripts for Forensic Review, (Thu, Oct 8th) Moderate SANS Internet Storm Center
2026-10-08 SANS Internet Storm Center

Reconstructing AI Agent Activity: Two New Scripts for Forensic Review, (Thu, Oct 8th)

We just did a major update to FOR577 and added a lot of new material on day 5 about investigating AI usage in incident response. In the new material we dicsuss 8 of the most popular AI coding assistants and agents including Claude Code, Codex, Gemini CLI, Cursor, Copilot, Warp, Windsurf, and Qwen Code. I've been using Claude Code and a little bit of Codex, b…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Operational Threat Radar
Advisory
Scans for Atlassian vulnerablity (CVE-2026-21589), (Wed, Oct 7th) Important CVE-2026-21589 SANS Internet Storm Center
2026-10-07 SANS Internet Storm Center

Scans for Atlassian vulnerablity (CVE-2026-21589), (Wed, Oct 7th)

On October 5th, Atlassian published patches for multiple products to fix an "Arbitrary File Access" vulnerability [CVE-2026-21589]. An attacker can read arbitrary files in the web application's directory, potentially exposing sensitive information such as configuration files.

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Operational Threat Radar
Advisory
More RMM Tools In the Wild, (Tue, Oct 6th) Critical SANS Internet Storm Center
2026-10-06 SANS Internet Storm Center

More RMM Tools In the Wild, (Tue, Oct 6th)

It seems that a trend started… I continue my journey discovering more RMM ("Remote Management & Monitoring") tools abused by threat actors! A few days ago, I wrote a diary[1] about ScreenConnect used in the wild. Today, I found another one.

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Operational Threat Radar
Advisory
TTY Logs and the Data it Captures, (Sun, Oct 4th) Moderate SANS Internet Storm Center
2026-10-05 SANS Internet Storm Center

TTY Logs and the Data it Captures, (Sun, Oct 4th)

For an experiment, I created a script [1] that parses and send the TTY logs collected from actors or bots activity that run various commands after they successfully login the DShield sensor. Those TTY logs are sent daily at the end of each day to the DShield SIEM [2] to be correlated with all the data.

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Operational Threat Radar
Advisory
User Agent Strings Curiosities, (Sun, Oct 4th) Moderate SANS Internet Storm Center
2026-10-04 SANS Internet Storm Center

User Agent Strings Curiosities, (Sun, Oct 4th)

Sometimes I have to smile, or my interest is triggered, when I review new User Agent Strings in the honeypot logs.

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Operational Threat Radar
Advisory
YARA-X 1.21.0 Release, (Sat, Oct 3rd) Moderate SANS Internet Storm Center
2026-10-03 SANS Internet Storm Center

YARA-X 1.21.0 Release, (Sat, Oct 3rd)

YARA-X's 1.21.0 release brings 5 improvements and 4 bugfixes.

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Operational Threat Radar
Advisory
ScreenConnect Client (Ab)used by Attackers, (Thu, Oct 1st) Important SANS Internet Storm Center
2026-10-01 SANS Internet Storm Center

ScreenConnect Client (Ab)used by Attackers, (Thu, Oct 1st)

Threat Actors do not always use top-notch techniques or very complex malware to perform their attacks. Sometimes, they just abuse of existing applications...

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Operational Threat Radar
Advisory
Scans for Wordfence Protected Websites, (Tue, Sep 29th) Moderate SANS Internet Storm Center
2026-09-29 SANS Internet Storm Center

Scans for Wordfence Protected Websites, (Tue, Sep 29th)

Starting yesterday, our sensors picked up a small number of scans for "wordfence-waf.php". This particular script is used by Wordfence, a solution to protect WordPress sites. During the Wordfence install, the wordpress-waf.php file will be created in the site's root directory [1].

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Operational Threat Radar
Advisory
1 2 3 4
Notification