Threat actor analysis, TTPs, IOCs, malware observations, advisory-style writeups, campaign summaries, OSINT findings, and defensive implications.
Threat Intel
Self-hosted Metabase, version x.58.0 through x.63.4, has an unauthenticated SQL injection in POST /api/session/reset_password that writes straight into the application database (the one holding accounts, connections, and settings, not your warehouse). An attacker who reaches that endpoint gets admin of the instance
SonicWall
SonicWall confirms active exploitation of CVE-2026-15409 and CVE-2026-15410 in SMA1000 appliances. Fixed versions, indicators, and response steps.
cve
CVE-2026-18577: N-able N-central Auth Bypass with Incomplete Patch and Cloudflare Tunnel Persistence Executive Summary CVE-2026-18577 is a critical authentication-bypass vulnerability in N-able N-central, the flagship Remote Monitoring and Management (RMM) platform. The flaw is an incomplete patch for CVE-2026-18556.
research
GhostLock is a Linux kernel use-after-free in futex priority inheritance. Patch and verification guidance for operators running containers, virtual machines, and CI jobs.
cve
CVE-2026-11405 — undocumented authentication backdoor in Tenda firmware granting admin access with a hidden password. No patch available since CERT/CC disclosure on July 6, 2026.
langflow
Langflow has THREE critical vulnerabilities actively exploited in the wild. With ~7,000 instances exposed on public internet and auto-login enabled by default, homelab operators are prime targets.
Threat Intel
URGENT: CVE-2025-53770/53771 ToolShell exploit chain under active exploitation since July 17, 2025. If you run on-prem SharePoint Server, you are vulnerable to unauthenticated RCE.