Latest Threat Intelligence — Week of October 12, 2026
Our security analysts track vendor advisories, CISA alerts, and live attack campaigns, then translate each one into what it means for a business that has to keep working. At the top of the feed right now: two chained zero-days that let attackers take over AhsayCBS backup servers with no login and no working patch — the server meant to rescue you after an attack is the one being hijacked; a China-linked group, Flax Typhoon, getting in through five older flaws in everyday FTP and DNS server software that were patched long ago but never installed; a Cisco SD-WAN Manager flaw already exploited to take over the system that configures every branch router; and the FBI warning that 86,644 stolen Fortinet VPN logins are still being sold to ransomware crews. Notice the pattern: none of these is fixed by a patch alone. One has no patch, one was patched long ago and never installed, and a stolen password stays valid until someone notices it being used. What decides the cost of an incident is how fast someone notices and what evidence you can hand the bank, the insurer and your customers afterward.