Latest Threat Intelligence — Week of November 9, 2026
Our security analysts track vendor advisories, CISA alerts, and live attack campaigns, then translate each one into what it means for a business that has to keep working. At the top of the feed right now: attackers getting full control of Ivanti remote-access VPNs (the gateway your staff use to reach the office network from home) even on fully patched devices, in a way Ivanti’s own integrity checker will not detect; a Zyxel network-switch fix that does not stop the attackers’ exploit, so only the newer patch closes it; an OpenSSH login flaw on some Linux servers that attackers began using within nine hours of it being made public; and a Chainalysis breach first described as limited that turned out to expose passwords and live access keys for every customer. Notice the pattern: the first fix, or the vendor’s first statement, is not where the story ends. A backdoor planted before you patch stays put, and a vendor’s breach becomes yours the moment a reused password or an unrotated key still works. What decides the cost of an incident is whether anyone checks for that earlier visit, and what evidence you can hand the bank, the insurer and your customers afterward.
