Threat Wire
BleepingComputer [Critical] FBI links $6.3 billion Binance crypto heist to North Korean hackers BleepingComputer [Critical] Alpine Linux rebuilds GitLab after attempted RCE attack CVE-2026-118539 [Critical] Security Affairs newsletter Round 602 by Pierluigi Paganini – INTERNATIONAL EDITION CVE-2026-58882 [Critical] SMS of Death: Android under attack, an invisible SMS can block calls and emergency services The Hacker News [Critical] CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key The Hacker News [Critical] FBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto Heist CVE-2026-111357 [Critical] U.S. CISA adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog BleepingComputer [Critical] Northflank security breach leads to abuse of customers' AI API keys BleepingComputer [Critical] FBI links $6.3 billion Binance crypto heist to North Korean hackers BleepingComputer [Critical] Alpine Linux rebuilds GitLab after attempted RCE attack CVE-2026-118539 [Critical] Security Affairs newsletter Round 602 by Pierluigi Paganini – INTERNATIONAL EDITION CVE-2026-58882 [Critical] SMS of Death: Android under attack, an invisible SMS can block calls and emergency services The Hacker News [Critical] CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key The Hacker News [Critical] FBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto Heist CVE-2026-111357 [Critical] U.S. CISA adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog BleepingComputer [Critical] Northflank security breach leads to abuse of customers' AI API keys

CyberWatch Newsroom Live Intel

Continuous enterprise threat intelligence tracking active in-the-wild zero-days (CISA KEV), Microsoft Windows KB cumulative updates, MSRC security advisories, and CVE remediation.

Last Checked: Nov 2, 2026 - 02:28:59 UTC (Hourly Auto-Sync Active)
Newsfeed (/feed) RSS Feed JSON API
All Security Bulletins 5,807 Active Zero-Days (KEV) 608 Microsoft Patch KBs 849 MSRC Live Wire 1,922 CISA Advisories 157 Threat Intel 2,629
Showing 24 of 82 advisories
Page 3 of 4
Apple Emergency Patch for iOS 26, macOS26, macOS15 (CVE-2026-86950), (Mon, Sep 28th) Moderate CVE-2026-86950 SANS Internet Storm Center
2026-09-28 SANS Internet Storm Center

Apple Emergency Patch for iOS 26, macOS26, macOS15 (CVE-2026-86950), (Mon, Sep 28th)

Apple today released patches for all of its operating systems. However, only patches for older branches include a security fix. The vulnerability being addressed in iOS 26, macOS 26 and macOS 15 is already being exploited. iOS and macOS 27 are not affected. Today's update for the current "27" branch does not address security issues, but fixes some functional…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Operational Threat Radar
Advisory
Wireshark 4.6.9 Released, (Sun, Sep 27th) Moderate SANS Internet Storm Center
2026-09-27 SANS Internet Storm Center

Wireshark 4.6.9 Released, (Sun, Sep 27th)

Wireshark release 4.6.9 fixes 19 vulnerabilities and 16 bugs.

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Operational Threat Radar
Advisory
One URL, Three Different Tricks, (Thu, Sep 24th) Moderate SANS Internet Storm Center
2026-09-24 SANS Internet Storm Center

One URL, Three Different Tricks, (Thu, Sep 24th)

Yesterday, we received a phishing email with an interesting link. At first sight, it looks like garbage, but every piece of it has been carefully crafted to confuse basic security controls. Here is the defanged link:

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Operational Threat Radar
Advisory
The Truth about GET and HTTP Standards, (Tue, Sep 22nd) Moderate SANS Internet Storm Center
2026-09-22 SANS Internet Storm Center

The Truth about GET and HTTP Standards, (Tue, Sep 22nd)

On Friday, Xavier talked about the newly introduced HTTP Query method. This new method was introduced to allow "GET" requests that include a body. The main reason for this was that GET requests typically do not contain a body. But what if they do?

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Operational Threat Radar
Advisory
LausivLoader analysis, or how to pass data between malware stages, (Thu, Sep 17th) Important SANS Internet Storm Center
2026-09-22 SANS Internet Storm Center

LausivLoader analysis, or how to pass data between malware stages, (Thu, Sep 17th)

At the end of August, a malspam message was caught in the quarantine of a mail gateway operated by one of my customers. The message was not especially remarkable – it asked the recipient to review some attached requirements and provide a price quotation for a fiber optic system and appeared to impersonate an employee of a legitimate company.

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Operational Threat Radar
Advisory
TerminalFix: PNG Steganography, (Mon, Sep 21st) Moderate SANS Internet Storm Center
2026-09-21 SANS Internet Storm Center

TerminalFix: PNG Steganography, (Mon, Sep 21st)

Microsoft Security Research published an interesting blog post "TerminalFix campaign deploys a reverse tunnel through multistage intrusion" about a malware campaign. The aspect that I want to take a closer look at, is the fact that the threat actors used PNG files with steganography. I reached out to the researchers and they kindly shared the IOCs for the PN…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Operational Threat Radar
Advisory
HTTP QUERY Method: The Grey Zone Between GET And POST., (Fri, Sep 18th) Moderate SANS Internet Storm Center
2026-09-19 SANS Internet Storm Center

HTTP QUERY Method: The Grey Zone Between GET And POST., (Fri, Sep 18th)

In June 2026 the IETF published RFC 10008[1], defining a new HTTP method: "QUERY". The HTTP protocol faced already by changes (HTTP/2, HTTP/3) but it’s the first new standard HTTP verb since "PATCH" in 2010!

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Operational Threat Radar
Advisory
MacOS 27 - First Boot, (Tue, Sep 15th) Moderate SANS Internet Storm Center
2026-09-15 SANS Internet Storm Center

MacOS 27 - First Boot, (Tue, Sep 15th)

I have not done this type of diary in a while: What traffic will you see from a system on boot, before a user logs in? I just took a quick look at macOS 27 "Golden Gate" to see what traffic you should expect. Here are some of the highlights:

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Operational Threat Radar
Advisory
Apple Updates Everything, (Mon, Sep 14th) Moderate SANS Internet Storm Center
2026-09-14 SANS Internet Storm Center

Apple Updates Everything, (Mon, Sep 14th)

Today, Apple released its annual update across all its operating systems. With that, Apple not only released new features but also patched 261 different vulnerabilities. This is the most vulnerabilities Apple has ever patched, but the increase is not as significant as other vendors' "post-AI" patch releases.

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Operational Threat Radar
Advisory
1 2 3 4
Notification