Security Articles
Daily threat intelligence and vulnerability analysis from our security team. We publish expert breakdowns of critical CVEs, active exploits, and emerging attack campaigns as they happen.
Our analysts monitor vendor advisories, CISA alerts, and underground threat activity to give you actionable guidance you can use the same day. Filter by severity below to find what matters most to your environment.
Updated October 29, 2026 — all 245 published advisories are browsable here. The five drawing the most attention right now:
North Korea’s Lazarus group breaching at least three companies through a fake job-candidate portfolio site that turned a trusted sign-in security plugin into the way in, then running its spying tools only in memory — there is no patch and no CVE, so remove security plugins nobody needs and tell HR and hiring managers that a polished résumé site followed by an “allow this plugin” prompt is a call to the security team, not a click;
an attacker replaying stolen Microsoft 365 sign-in tokens (the pass Microsoft hands you after the password and multifactor prompt are already done) to take over 97 accounts at 79 organizations, registering rogue devices, swapping the multifactor app and hiding emails about payroll, direct deposit and bank details with inbox rules — there is no patch, because nothing is broken, and a password reset alone does not evict the attacker, so after any mailbox compromise also remove unknown devices and multifactor methods and check for hidden inbox rules;
Apple finally fixing an actively exploited iPhone and iPad flaw on older devices that cannot run the newest iOS, a bug in how the device draws images that lets a booby-trapped file run an attacker’s code (CVE-2026-86950, rated 8.8 out of 10, on CISA’s actively exploited list since September 29) — the iPhone XS, XS Max and XR and several older iPads went about four weeks with no fix at all, and those hand-me-down phones and lobby tablets are the devices nobody checks, so find anything still on iOS 18 and update it to 18.7.11 this week;
two emergency fixes for PHP, the language running underneath WordPress and most small-business websites and customer portals, after flaws nicknamed PHP2Shell let someone with no login take over the server (CVE-2026-109618 and CVE-2026-109619, each rated 9.2 out of 10) — attackers began trying them before the fixes shipped, and a fully patched website does not help if the PHP underneath it is old, so ask your web host or developer to confirm you are on PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35; and
attackers planting backdoors on Nextcloud file-sharing servers through the built-in Collabora document-editing add-on, with no login, then hunting the company files for password vaults and crypto wallets (CVE-2026-110447, rated 9.2 out of 10, now on CISA’s actively exploited list) — the fix shipped September 11 but the warning only went out October 14, so update the add-on to 26.4.303 or remove it, then check for a backdoor, because on a server that was already hit the update is the start of the cleanup, not the end.
Four of the five have already been used in real attacks, attackers are already trying the fifth, and for three of them (Lazarus, Microsoft 365 and Collabora) an update or a password reset alone does not make you safe. The cost is decided by how fast someone notices. If nobody is reading the alerts at 2 a.m., our
24/7 staffed security operations center handles the detection and the response.
