Security Articles
Daily threat intelligence and vulnerability analysis from our security team. We publish expert breakdowns of critical CVEs, active exploits, and emerging attack campaigns as they happen.
Our analysts monitor vendor advisories, CISA alerts, and underground threat activity to give you actionable guidance you can use the same day. Filter by severity below to find what matters most to your environment.
Updated October 27, 2026 — all 243 published advisories are browsable here. The five drawing the most attention right now:
an attacker replaying stolen Microsoft 365 sign-in tokens (the pass Microsoft hands you after the password and multifactor prompt are already done) to take over 97 accounts at 79 organizations, registering rogue devices, swapping the multifactor app and hiding emails about payroll, direct deposit and bank details with inbox rules — there is no patch, because nothing is broken, and a password reset alone does not evict the attacker, so after any mailbox compromise also remove unknown devices and multifactor methods and check for hidden inbox rules;
a suspected nation-state group hiding an implant in the memory of Fortinet FortiGate firewalls so its VPN sessions skip the firewall’s own security checks, after stealing the configurations and passwords of more than 500 firewalls from the console that manages them (CVE-2025-61624, now on CISA’s actively exploited list) — the implant opens no ports and leaves nothing on disk, so an outside scan looks clean; upgrade, then change every firewall and VPN password, because the update closes the hole but does not undo the theft;
attackers using a stolen ConnectWise Cloud Backup (formerly SkyKick) app credential to sign straight into 173 Microsoft 365 tenants on October 15, with no password and no multifactor prompt — there is no patch for this, because the app itself was the way in, so check your Microsoft 365 sign-in logs for the app and remove any credentials added to apps since October 13;
two emergency fixes for PHP, the language running underneath WordPress and most small-business websites and customer portals, after flaws nicknamed PHP2Shell let someone with no login take over the server (CVE-2026-109618 and CVE-2026-109619, each rated 9.2 out of 10) — attackers began trying them before the fixes shipped, and a fully patched website does not help if the PHP underneath it is old, so ask your web host or developer to confirm you are on PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35; and
attackers planting backdoors on Nextcloud file-sharing servers through the built-in Collabora document-editing add-on, with no login, then hunting the company files for password vaults and crypto wallets (CVE-2026-110447, rated 9.2 out of 10, now on CISA’s actively exploited list) — the fix shipped September 11 but the warning only went out October 14, so update the add-on to 26.4.303 or remove it, then check for a backdoor, because on a server that was already hit the update is the start of the cleanup, not the end.
Four of the five have already been used in real attacks, attackers are already trying the fifth, and for four of them (Microsoft 365, ConnectWise, FortiGate and Collabora) an update or a password reset alone does not make you safe. The cost is decided by how fast someone notices. If nobody is reading the alerts at 2 a.m., our
24/7 staffed security operations center handles the detection and the response.
