soc

Shai-Hulud Hades PyPI Campaign: 19 Packages Trojanized via Wheel Startup Hooks A PyPI supply-chain campaign in the Shai-Hulud / Mini Shai-Hulud / Miasma lineage compromised 19 Python packages by shipping trojanized wheel artifacts. Researchers observed 37 malicious wheels that add a Python startup hook (*.pth) to trigger code execution, then bootstrap a Bun runtime to […]

Handala Claims It Disrupted Israeli Radar Systems: Here’s What We Actually Know On the same day that Iran and Israel traded missile strikes in their most serious exchange since the April ceasefire, an Iranian-linked hacker group called Handala posted a series of messages on Telegram claiming it had launched crippling cyberattacks against Israeli military and […]

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-42271 BerriAI LiteLLM Command Injection Vulnerability CVE-2026-50751 Check Point Security Gateway Improper Authentication Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. Binding […]

Cisco has disclosed a seventh SD-WAN zero-day exploited in 2026, tracked as CVE-2026-20245. The flaw affects the command-line interface of Cisco Catalyst SD-WAN Manager and can allow an authenticated remote attacker with netadmin privileges to execute arbitrary commands as root by uploading a crafted file. Cisco says exploitation has already been observed in limited cases, […]

A newly disclosed denial-of-service vulnerability, tracked as CVE-2026-49975, shows how long-known HTTP/2 weaknesses can still be chained into a highly effective modern attack. SecurityWeek reports that researchers at Calif demonstrated an HTTP/2 Bomb exploit capable of knocking major web servers offline within seconds by combining a compression bomb with a Slowloris-style hold that prevents the […]

2026 FIFA World Cup Threat Landscape: The Kickoff for Cybercriminals The fraud and threat ecosystem targeting the 2026 FIFA World Cup is already live, with thousands of phishing domains, active credential theft campaigns, and nation-state actors in position months before the first match. Starting June 11, the FIFA World Cup 2026 will unite fans, teams, […]

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-28318 SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 22-01: Reducing the Significant […]

CVE-2026-20230: Cisco Unified CM WebDialer SSRF Can Lead to Root-Level Compromise Cisco has released fixes for CVE-2026-20230, an unauthenticated remote vulnerability affecting Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (SME). The flaw is an SSRF issue that can be chained into an arbitrary file write on the underlying operating system, […]

Dark Web Profile: Vect Ransomware Most new ransomware operations spend their first months in the shadows, courting affiliates one at a time on closed forums. Vect did the opposite. Within four months of its December 31, 2025 debut on a Russian-language cybercrime forum, the group had published its first 25 victims across five continents, formalized […]

HTTP/2 Bomb: How Default Configurations Open a New DoS Vector A newly disclosed Denial-of-Service (DoS) technique dubbed HTTP/2 Bomb can crash or stall servers that run default HTTP/2 configurations across several widely deployed stacks. The technique chains two behaviors that are individually familiar to defenders: header-related amplification and Slowloris-style connection holding. Combined, they can exhaust […]