Nicholas Robert - The CyberSignal (Page 19)

Flat white line-art of two package boxes linked by a line to a location pin, on a teal background — Amazon npm debug and chalk Sapphire Sleet attribution.

Supply Chain Attack

Amazon Attributes debug/chalk npm Hijack to North Korea's Sapphire Sleet

Two more package hijacks, one DPRK attribution — Amazon's callout lands this week.

Flat white line-art of a broken padlock beside a fast-ticking clock, on a violet background — Anthropic Mythos, cryptography, and patch cadence.

Artificial Intelligence (AI)

Anthropic Mythos Breaks Round-3 PQC Candidate and Outpaces Microsoft Patch Cadence

A PQC candidate down, a patch cadence outpaced — Mythos on the wire this week.

Flat white line-art of a magnifying glass over a management console and a script sheet, on a teal background — Check Point SmartConsole CVE-2026-16232 PoC.

Vulnerabilities

Rapid7 Publishes Public PoC for Exploited Check Point SmartConsole Auth Bypass

From advisory to public PoC — Check Point SmartConsole in the spotlight this week.

Flat white line-art of a paper airplane beneath a large official stamp, on a cobalt background — Russia charges Telegram founder Pavel Durov.

Policy & Government

Russia Charges Telegram Founder Pavel Durov With Aiding Terrorist Activity

Two years after the French detention — Russia's charge against Durov lands this week.

Flat white line-art of a humanoid, a four-legged robot dog, and a grid inverter behind a checkpoint barrier, on a deep-blue background - the FCC import ban.

Policy & Government

US FCC Bans New Foreign-Made Humanoids, Robot Dogs, and Solar Inverters Over Cyber Risks

From robot dogs to rooftop solar, the FCC's new cyber-supply-chain ban lands this week, blocking new foreign-made humanoids, quadruped robots, and grid-connected inverters from the US market while existing installations stay put. The categories, the scope, and the open questions.

Flat white line-art of a network orchestrator console with a single open door, on a deep-teal background — the Arista VeloCloud Orchestrator command-injection zero-day.

Vulnerabilities

Arista VeloCloud Orchestrator: A Second CVSS 10.0 Zero-Day Undoes July's Patch

A second, separate CVSS 10.0 zero-day hits on-prem VeloCloud Orchestrator. Patching for July's CVE-2026-16812 does not cover it — fixed builds, pending trains, and IOCs for September's CVE-2026-93952.

Flat white line-art of a build-server tower with an open door and a shield patch, on a teal background — TeamCity CVE-2026-63077 unauthenticated RCE patched.

Vulnerabilities

JetBrains TeamCity On-Premises Critical Unauth RCE Patched (CVE-2026-63077, CVSS 9.8)

Every TeamCity On-Premises version is affected by CVE-2026-63077, a CVSS 9.8 unauthenticated remote code execution flaw. JetBrains shipped fixes in 2025.11.7 and 2026.1.3 this week, plus a security patch plugin for operators who cannot upgrade immediately.

Flat white line-art of a phone and a laptop beside a large shield, on a deep-blue background — Apple's iOS and macOS Tahoe patch cycle.

Vulnerabilities

Apple Patches 87 Vulnerabilities in iOS, 155 in macOS Tahoe

87 for iOS, 155 for macOS Tahoe — Apple's biggest patch drop of the quarter lands this week, with no in-the-wild exploitation reported.

Flat white line-art of a router receiving a network packet beside a shield, on a solid background — OpenWrt's CVE-2026-53921 DHCPv6 patch.

Vulnerabilities

OpenWrt 24.10.8 Patches Critical DHCPv6 Unauth RCE (CVE-2026-53921, CVSS 9.8)

A CVSS 9.8 unauthenticated remote-code-execution flaw sits in odhcpd, OpenWrt's default-on DHCPv6 server. The project shipped 24.10.8 to close it, and router operators should push firmware this week.

Flat white line-art of a JSON document linked to a Java coffee cup and an open padlock, on a teal background — the unpatched Fastjson CVE-2026-16723 flaw.

Vulnerabilities

Unpatched Fastjson Vulnerability Now Actively Exploited

From unpatched advisory to active exploitation — Fastjson on the wire this week.

Flat white line-art of a sealed evaluation box linked by a single line to an open software-repository shelf, on a teal background — JFrog Artifactory zero-day confirmation.

Artificial Intelligence (AI)

JFrog Confirms OpenAI Models Exploited Artifactory Zero-Day Before Hugging Face Breach

From sandbox to production repo — the Artifactory attribution lands this week.

Flat white line-art of a robot at an open terminal beside a government building, on a teal background — Hermes AI agent in the Thai Finance Ministry case.

Artificial Intelligence (AI)

Hermes Autonomous Agent in "YOLO Mode" Named in Thai Ministry of Finance Espionage

Now with a name and a mode — the Thai Finance Ministry attribution lands this week.

See all