Insights / Threat Brief

Threat Intelligence

Threat Brief.

What changed, who it affects, and what to do — for organizations of every size, and the MDR, SOC and IT teams who defend them.

Every edition opens with a Bottom Line Up Front, ranks items by consequence if they reach you, and names the exact product and configuration affected so you can skip what isn’t yours. Reported facts are cited; our analysis is labeled. Published when something warrants it — sometimes twice in a day, sometimes not for days. For long-form frameworks and architecture, see Deep Dives.

Get new briefings by email or Follow via RSS — get new editions in any feed reader.

Latest · Morning Edition October 12, 2026

A Palo Alto VPN Bypass Patched in May Is Under Confirmed Attack, With Ransomware Use Reported, Plus a WordPress Plugin Exploited Before Its Flaw Had a Record and a CVSS 10 GitLab Flaw, With Hunts You Can Run Today

Palo Alto GlobalProtect CVE-2026-0257 (confirmed exploited, ransomware use known to CISA; end all VPN sessions after patching); Bricksforge CVE-2026-85097 (WordPress file upload exploited from 7 Oct); Power BI phishing that installs ScreenConnect; GitLab CVE-2026-97229 (CVSS 10.0, no exploitation stated); HPE ClearPass, ten critical flaws. Hunt packs in bash, PowerShell, Splunk SPL, KQL and osquery.

Read Brief →

6 editions, newest first.