Latest Threat Intelligence — Week of November 2, 2026
Our security analysts track vendor advisories, CISA alerts, and live attack campaigns, then translate each one into what it means for a business that has to keep working. At the top of the feed right now: a flaw rated 10 out of 10 in Canonical’s LXD and MicroCloud server tools that lets a stranger pose as a trusted administrator using nothing but that administrator’s public certificate, which is meant to be shared; attackers trying to catch WordPress websites in the seconds while an update installs, with nearly 63,000 attempts blocked in a single day; a Drupal online-store flaw being used to get past the permission checks on orders and payments; and a Cisco firewall bug, confirmed in real attacks, that reboots the firewall and drops every remote worker on the VPN. Notice the pattern: in each case the fix is out, and the question that decides the cost is what happened before you installed it. A planted certificate or a tampered order does not disappear when the update installs. What decides the cost of an incident is whether anyone checks for that earlier visit, and what evidence you can hand the bank, the insurer and your customers afterward.
