Cisco tied an active firewall campaign to a chained set of flaws
Cisco said evidence strongly indicated attackers used CVE-2025-20333 and CVE-2025-20362 in attacks against Secure Firewall ASA and FTD devices. A companio…
1 min read · Source brief↗
The dispatch / historical archive
A longer memory.
A sharper perspective.
Original historical analysis alongside the existing sourced news desk. Read what happened, what the evidence establishes, and what a defender can learn.
35 pieces · source dates, never backdated publication
Five additions to CISA's exploited-vulnerability catalogue sharpened the patch queue
CISA added flaws affecting Adminer, Cisco IOS and IOS XE, Fortra GoAnywhere MFT, Libraesva Email Security Gateway, and Sudo after finding evidence of acti…
1 min read · Source brief↗
F5's incident disclosure turned supplier trust into an inventory problem
F5 described a major incident involving a sophisticated nation-state actor and access to BIG-IP source code and some knowledge-management files. The compa…
1 min read · Source brief↗
React Server Components received a critical unauthenticated RCE fix
The React team disclosed CVE-2025-55182, affecting several React Server DOM packages in versions 19.0, 19.1.0, 19.1.1 and 19.2.0. Patched versions were pu…
1 min read · Source brief↗
The UK NCSC warned that state-aligned hacktivists kept targeting public services
The NCSC warned UK organizations about persistent disruptive activity by Russian state-aligned hacktivist groups, building on a December 2025 internationa…
1 min read · Source brief↗
Ivanti disclosed limited exploitation of flaws in on-premises EPMM
Ivanti issued an update for Endpoint Manager Mobile and said it knew of a very limited number of exploited customer environments. The company separated th…
1 min read · Source brief↗
Cisco SD-WAN fixes arrived with a warning to look for unauthorized changes
CERT-EU summarized Cisco advisories for critical and high-severity flaws in Catalyst SD-WAN controllers and SD-WAN Manager. It noted that CVE-2026-20127 h…
1 min read · Source brief↗
A SharePoint flaw moved into the known-exploited queue
CERT-EU reported that Microsoft updated its January advisory for CVE-2026-20963 on 17 March, and CISA added the unauthenticated remote-code-execution flaw…
1 min read · Source brief↗
Microsoft described AI as an accelerator inside familiar attack chains
Microsoft Threat Intelligence said actors were using AI to speed research, improve lures, develop malware, and triage stolen data while humans generally r…
1 min read · Source brief↗
AI-assisted discovery made patch latency a design constraint
Google Cloud and Mandiant argued that capable models were compressing the vulnerability-discovery and exploitation cycle, while the same techniques could …
1 min read · Source brief↗
A critical PAN-OS flaw arrived with limited-exploitation evidence
CERT-EU relayed Palo Alto Networks’ disclosure of a critical unauthenticated remote-code-execution flaw in PAN-OS and the vendor’s observation of limited …
1 min read · Source brief↗
Ivanti Sentry updates addressed two unauthenticated RCE flaws
CERT-EU summarized Ivanti’s 9 June advisory for two critical vulnerabilities in Sentry products that could permit unauthenticated remote code execution.Im…
1 min read · Source brief↗
Open-source repository compromises forced a broader supply-chain playbook
Google Threat Intelligence Group and Mandiant described multiple large-scale campaigns across 2025 and the first half of 2026, then published defensive gu…
1 min read · Source brief↗
Critical NetScaler fixes put internet-facing gateways back at the top of the queue
CERT-EU summarized Citrix’s advisory for multiple critical vulnerabilities affecting NetScaler ADC and NetScaler Gateway and recommended prompt updates.Im…
1 min read · Source brief↗
Passkey-themed social engineering targeted the enrollment path
Microsoft documented campaigns that used passkey-themed lures, then registered attacker-controlled authentication methods and moved through cloud workload…
1 min read · Source brief↗
Equifax's first disclosure made application exposure a consumer-data incident
The 2017 filing separated the intrusion window, discovery date and still-provisional impact count.
2 min read · Archive analysis↗
WannaCry put ransomware exposure on the industrial operator's checklist
An ICS-CERT alert connected a global malware event to product notices and defensive coordination.
2 min read · Archive analysis↗
SolarWinds Orion forced defenders to treat trusted updates as a possible entry point
CISA's December 2020 alert identified affected Orion releases and an active exploitation concern.
2 min read · Archive analysis↗
Exchange's 2021 emergency response went beyond installing updates
The federal directive treated exploitation evidence and server exposure as separate response questions.
2 min read · Archive analysis↗
Colonial Pipeline showed how an IT ransomware event can interrupt a physical service
A joint CISA–FBI advisory separated affected IT systems from unconfirmed operational-technology intrusion.
2 min read · Archive analysis↗
Log4Shell turned a library flaw into a product-inventory problem
The December 2021 joint guidance told operators to find embedded Log4j, not just patch a visible application.
2 min read · Archive analysis↗
3CX demonstrated a supply-chain compromise that began with another supplier
Mandiant's investigation traced a trojanized desktop application back to a prior software compromise.
2 min read · Archive analysis↗
MOVEit made a file-transfer edge service a data-theft priority
The 2023 exploitation showed why a fixed server still needs a look back at transferred and stored data.
2 min read · Archive analysis↗
Storm-0558 exposed a cloud token-validation boundary
Microsoft's 2023 account describes unauthorized email access through forged authentication tokens.
2 min read · Archive analysis↗
Okta's support-system breach put session material in incident scope
The identity provider's November 2023 account distinguished accessed case files from confirmed session hijacks.
2 min read · Archive analysis↗
Snowflake customer intrusions traced to stolen credentials, not a platform breach
Mandiant's 2024 investigation separated cloud-service compromise from compromise of accounts using that service.
2 min read · Archive analysis↗
The xz backdoor hid across source archives and build behavior
The discoverer's March 2024 message is a rare first-hand record of a supply-chain near miss.
2 min read · Archive analysis↗
NIST CSF 2.0 made governance an explicit security function
The February 2024 revision broadened scope beyond critical infrastructure and elevated supply-chain risk.
2 min read · Archive analysis↗
Secure by Design shifted attention from users to product makers
CISA's 2023 principles asked suppliers to take ownership of customer security outcomes.
2 min read · Archive analysis↗
The updated ransomware guide treated restoration as a tested capability
CISA's 2023 guide joined offline backups, integrity tests and an incident-response checklist.
2 min read · Archive analysis↗
Volt Typhoon guidance focused on persistent access to critical infrastructure
The 2024 joint advisory treated ordinary administrative activity as a detection challenge.
2 min read · Archive analysis↗
GitHub's workflow study put CI configuration in the security review
A 2025 first-party research brief described vulnerable open-source workflows and new analysis support.
2 min read · Archive analysis↗
Water-system guidance translated cyber risk into operator actions
A 2024 CISA–EPA–FBI release addressed small and large utilities without assuming identical capacity.
2 min read · Archive analysis↗
MITRE ATT&CK v8 joined pre-compromise behavior to the enterprise model
The October 2020 release added reconnaissance and resource-development tactics while retiring PRE-ATT&CK.
2 min read · Archive analysis↗
Change Healthcare exposed a national payment-continuity dependency
A March 2024 CMS bulletin documented operational disruption without treating it as a technical root-cause report.
2 min read · Archive analysis↗
No matches. Clear your search or choose another topic.