Node-RED Under Attack: Find, Lock Down and Hunt CVE-2026-58115

CVE-2026-58115 is being exploited to plant bots and web shells via exposed Node-RED editors. How to find them, enable adminAuth and hunt for malicious flows.

The $6.3B Binance Heist Began on One Laptop: What to Do Now

Binance lost about $6.3B after a DevOps laptop was compromised; the FBI blames North Korea's TraderTraitor. What happened, who is affected and how to defend.

WordPress Upgrade-Window RCE: What Site Owners Must Do Now

WordPress 7.1.4 fixes CVE-2026-119977, an unauthenticated upgrade-window RCE now probed at scale. How it works, who is exposed, and how to block and patch.

Ivanti Connect Secure Zero-Day Chain: A Hunt and Harden Guide

UTA0576 chained three Ivanti Connect Secure zero-days to get root and raid Active Directory. How to patch, hunt from your SIEM and AD logs, and recover safely.

GitLab CVSS 10 Regex RCE Hits CISA KEV: What Self-Managed Admins Must Do

CISA adds GitLab CVE-2026-97229 to KEV after attacks on Alpine Linux. Which versions fix both CVSS 10 regex RCEs, the Ruby catch, detection and a response checklist.

The eMudhra CA Key Compromise: What It Means for Your Business

Eight eMudhra CA keys could be computed from public data. Browsers are safe, but servers, apps and devices may not be. A plain-language action plan for businesses.

Volt Typhoon Silent Train: What Happened and What to Do Now

Volt Typhoon's Silent Train hides zero-day attacks on SD-WAN, RMM and network management tools behind disposable relays. What happened, who is at risk, what to do.

Magento PolyShell Hits CISA KEV: What Store Owners Must Do Now

CISA adds Magento PolyShell (CVE-2026-48356) to KEV as a 953-store loader campaign grows. Timeline, compromise checks, clean-up steps and the BlockStrap patch.

Token Spraying in Microsoft 365: A Hunt and Harden Guide

A token-spraying campaign hijacked 97 Microsoft 365 accounts despite MFA. KQL hunts, rogue-device checks and Conditional Access fixes to find and stop it.

ConnectWise Cloud Backup Breach: What Happened and What to Do Now

China-aligned Storm-0940 abused ConnectWise Cloud Backup app credentials to hit 2,250+ Microsoft 365 tenants. Timeline, KQL hunts and a clean-up checklist.

LiteLLM 1.107.0 Compromise: What Happened and What to Do Now

LiteLLM 1.107.0 on PyPI and Docker shipped a credential stealer on 21 Oct 2026. Timeline, who is affected, detection queries and a clean-up checklist.