What Is Cyber Threat Intelligence (CTI)? Types and Use Cases

Cyber threat intelligence (CTI) explained — the four types, the CTI lifecycle, where intelligence comes from, and how organizations turn it into action.

Threat Intelligence and Threat Actors: The Complete Guide

A complete guide to threat intelligence and threat actors — the four types of CTI, the major actor categories, the intelligence lifecycle, and the frameworks defenders use.

What Is Cyber Resilience?

A clear guide to cyber resilience — how it goes beyond cybersecurity, the four pillars, the key practices, and the frameworks organizations use to build it.

Data Breach Notification Laws Explained

A clear guide to data breach notification laws — what triggers them, who must be told, the major frameworks, the 72-hour rule, and how to prepare.

Mythos: NSA Reportedly Readies It for Offense as Anthropic Publishes a Misuse Analysis

Two Mythos threads landed this cycle: TechCrunch reports the NSA is said to be readying Anthropic's Mythos for cyber operations despite a federal restriction, while Anthropic published an analysis of 832 accounts banned for malicious cyber activity, mapped to MITRE ATT&CK.

Trusted Channels Turned Hostile: a Rust npm Worm, a Poisoned Browser, and Stripe Card Skimmers

Three disclosures this cycle share one thesis: attackers borrowing the trust of legitimate channels. A Rust-written npm worm (IronWorm), a cryptominer slipped into Hola Browser, and a Magecart skimmer hosted inside Stripe each hide in traffic defenders are inclined to allow.

FIFA World Cup Scams Are Already Live — Days Before Kickoff, the FBI Is Warning Fans

Days before the June 11 kickoff, the FBI and researchers warn that FIFA World Cup 2026 fraud is already live — thousands of lookalike FIFA domains, banking malware hidden in pirate streaming apps, and login pages cloned well enough to take over real accounts.

PCPJack Hijacked 230 AWS, Google Cloud, and Azure Servers Into a Covert SMTP Relay

Hunt.io found that a threat actor called PCPJack hijacked about 230 AWS, Google Cloud and Azure servers into a covert SMTP relay network — quietly converting business servers into verified mail proxies synced to a downstream consumer every five minutes.

OP-512: A China-Linked Cluster Is Planting Custom Web Shells on Microsoft IIS Servers

ReliaQuest disclosed OP-512, a previously unreported, China-linked espionage cluster that plants a custom three-web-shell framework on Microsoft IIS servers — the fourth such group to target IIS in a year. For anyone running IIS, it is a prompt to go hunting.

DentaQuest Breach Hits 2.6 Million as ShinyHunters Leaks a 234 GB Data Trove

DentaQuest, a Sun Life dental-benefits administrator serving 35 million people, confirmed a breach of 2.6 million accounts after ShinyHunters leaked about 234 GB of data — including names, dates of birth, Medicaid IDs and health-insurance information.

Cisco SD-WAN Manager Zero-Day CVE-2026-20245 Is Exploited in the Wild With No Patch Yet

Cisco warns that CVE-2026-20245, a zero-day in Catalyst SD-WAN Manager, is being exploited to gain root, with no patch available. Exploitation needs netadmin access — obtainable by chaining CVE-2026-20182 — making it Cisco's seventh exploited SD-WAN zero-day of 2026.

What Is Digital Forensics?

A clear guide to digital forensics — the branches, the investigative process, chain of custody, and how forensics supports incident response and prosecutions.

Vulnerabilities

A Single GitHub Issue Could Hijack Repos Using Anthropic's Claude Code Action — Now Fixed

Researcher RyotaK of GMO Flatt Security found a flaw in Anthropic's Claude Code GitHub Action that let a single opened issue take over public repos running it. Anthropic fixed it within days (v1.0.94) and paid a bounty; the durable lesson is product-agnostic.

Data Breaches

UN World Food Programme Breach Exposes Data on 600,000 Gaza Aid Recipients

The UN World Food Programme says its self-registration application for Palestine was breached, exposing names, ID and mobile numbers and location data for roughly 600,000 Gaza households — potentially the largest-known breach of humanitarian beneficiary data to date.

Critical Infrastructure

CISA and Partners Warn Hackers Are Targeting Fuel-Tank Monitoring Systems

CISA, the FBI, NSA, Department of Energy and other US agencies warn that hackers are targeting internet-exposed automatic tank gauge (ATG) systems that monitor fuel storage, modifying device settings via command execution. The fix: get them off the public internet.

Nation-State Cyber Threats

Five Eyes: China Is Using LinkedIn and Job Sites to Recruit Insiders

A joint Five Eyes advisory warns that Chinese intelligence officers, posing as recruiters and consultants for front companies, are using LinkedIn, Indeed and Upwork to recruit government, military and cleared personnel — and anyone with access to classified or privileged information.

Vulnerabilities

WordPress and Magento Plugin RCE Keeps Coming: Everest Forms Exploited, Mirasvit Added to KEV

Two more plugin RCEs are under active exploitation: Everest Forms Pro CVE-2026-3300 (CVSS 9.8), a PHP-injection flaw Wordfence has blocked tens of thousands of times, and Magento's Mirasvit Cache Warmer CVE-2026-45247 (CVSS 9.8), now added to CISA's KEV catalog.

Artificial Intelligence (AI)

A Poisoned Notification Can Hijack Google Gemini's Voice Assistant on Android

SafeBreach researchers found that a single poisoned notification — from WhatsApp, Slack or SMS — could hijack Google Gemini's voice assistant on Android with no malicious app installed, reaching smart-home controls and poisoning the assistant's long-term memory. Google has patched it.

Vulnerabilities

One Click in VS Code Steals Your GitHub Token — the Researcher Skipped Coordinated Disclosure

Researcher Ammar Askar disclosed a one-click attack via VS Code's GitHub.dev that steals a GitHub OAuth token with read-write access to private repos. He published the PoC with about an hour's notice, blaming Microsoft's disclosure process.

Vulnerabilities

The Bugs AI Found This Week: an HTTP/2 'Bomb' and a Two-Year-Old Redis RCE

Two vulnerabilities disclosed this cycle were found by AI tooling: HTTP/2 Bomb (CVE-2026-49975), a remote DoS that crashes NGINX, Apache, IIS, Envoy and Cloudflare Pingora in default config, and CVE-2026-23479, a two-year-old authenticated RCE in Redis.

Vulnerabilities

Cisco Unified CM CVE-2026-20230: A Public PoC for an Unauthenticated SSRF That Climbs to Root

Cisco patched CVE-2026-20230, an unauthenticated server-side request forgery flaw in Unified Communications Manager that lets a network attacker write files and escalate to root. Public proof-of-concept code is already out; Cisco's PSIRT reports no in-the-wild exploitation yet.

CVE Watch

The Top CVEs of May 2026: Edge Devices Under Active Attack While Patch Tuesday Goes Quiet

Microsoft shipped its first zero-day-free Patch Tuesday since June 2024 — but the month's real action was elsewhere: a CISA Emergency Directive for Cisco SD-WAN, exploited PAN-OS flaws, and a Drupal core SQL-injection, all under active attack.

Cybersecurity 101

What Is an Incident Response Plan?

A clear guide to incident response plans — what they are, why every organization needs one, what they should contain, and how to build, test, and maintain one.

Policy & Government

Pentagon's Top Cyber Official Wants Cyber in Every Operation — and Security Built Into AI From Day One

The Pentagon's top cyber official, Katherine Sutton, says the Defense Department must pull cyber 'out of its silo' and build it into every operation from day one — and must bake security into the AI tools it adopts, rather than treating it as an afterthought.