The CyberSignal (Page 27)

Latest

Editorial illustration of a mesh net trawling exposed AI service panels for key tags, marking the NadMesh Go botnet hunting cloud keys and Kubernetes tokens.

Threat Intelligence

Researchers Document “NadMesh” Go Botnet Hunting Exposed AI Services for Cloud Keys and Kubernetes Tokens

A botnet targeting self-hosted AI tooling for cloud keys — defender review for organizations exposing AI services this weekend.

Illustration of a tiny key inflating a huge balloon beside a server, marking Okta's HollowByte OpenSSL memory-freeze disclosure after a silent June fix.

Vulnerabilities

Okta Red Team Publishes "HollowByte" OpenSSL Memory-Freeze Vulnerability Detail After Silent June Fix

A silent OpenSSL fix gets belated technical detail: eleven bytes of TLS request data can reportedly strand up to 131 KB of server memory. Defender review is warranted across OpenSSL-dependent infrastructure this weekend.

Editorial illustration of a signing seal lifted from a certificate vault, marking Expel's attribution of the DigiCert breach to the CylindricalCanine subgroup.

Supply Chain Attack

Expel Attributes April 2026 DigiCert Breach to “CylindricalCanine” GoldenEyeDog Subgroup

A code-signing-integrity attribution against a Chinese cybercrime subgroup — and a prompt for supply-chain defenders to review how much trust their pipelines place in a valid signature.

Editorial illustration of a website building block with an open back door and a blueprint beside it, marking the wp2shell WordPress Core unauthenticated RCE.

Vulnerabilities

'wp2shell' WordPress Core Unauthenticated RCE Patched in 6.9.5 and 7.0.2 (CVE-2026-63030)

An unauthenticated remote-code-execution flaw in WordPress Core, disclosed as wp2shell, affects the 6.9 and 7.0 branches. Fixes shipped July 17 in 6.9.5 and 7.0.2 — defender teams and hosting providers should verify patch status rather than assume forced updates landed.

Editorial illustration of a banner planted on a breached gateway appliance, marking attribution of SonicWall SMA zero-day exploitation to INC Ransomware.

Ransomware

Dark Reading Attributes SonicWall SMA Zero-Day Exploitation to INC Ransomware Operation

INC Ransomware named as the SonicWall SMA zero-day exploiter — defender teams stay in accelerated verification posture this weekend.

Editorial illustration of seven npm package boxes wired to a blockchain-link control node, marking the ViteVenom campaign against Vite frontend tooling.

Supply Chain Attack

Checkmarx Documents “ViteVenom” Campaign Compromising Seven Vite npm Packages With Blockchain C2

Another JavaScript-ecosystem compromise with a novel blockchain-C2 angle — seven scoped npm packages impersonating the Vite tooling namespace, and defender inventory work this weekend.

Editorial illustration of a magnifying glass over a cracked shared-document portal, marking Rapid7's deep-dive on the exploited SharePoint flaw CVE-2026-58644.

Vulnerabilities

Rapid7 Publishes Deep-Dive on Exploited SharePoint CVE-2026-58644

Rapid7 goes deep on the SharePoint CVSS-9.8 RCE — defender-team detection-engineering review this weekend.

Editorial science-poster illustration of the six major threat actor categories, shown as silhouette portraits each marked with a small identifying icon.

Cybersecurity 101

Types of Threat Actors: From Cybercriminals to Nation-States

The major categories of cyber threat actors explained — nation-states, cybercriminals, hacktivists, insiders, and script kiddies — with motivations and defense implications.

Editorial illustration of an email with hidden salt grains slipping past an AI filter lens, marking the text-salting technique seen in over a million phishing emails.

Phishing

Researchers Document "Text Salting" — Hidden-Text Technique Reportedly Bypasses AI-Based Email Security Filters at Scale

A scale-significant AI-filter-bypass research beat — defender review for AI-heavy email-security stacks this week.

Editorial illustration of an OT switch with three chained keys reaching a root terminal, marking Unit 42's Siemens ROX II zero-day trilogy analysis.

Vulnerabilities

Unit 42 Publishes “Three Steps to the Terminal” Analysis of Chained Siemens ROX II Zero-Day Vulnerabilities

Three chained OT zero-days in Siemens ROX II — a defender review for industrial operators this week, with Unit 42's analysis and Siemens's fixed firmware as the anchors.

Editorial illustration of a coiled serpent slipping into a government building's document tray, marking Kaspersky's GoSerpent espionage malware in Southeast Asia.

Nation-State Cyber Threats

Kaspersky Documents "GoSerpent" Malware Targeting Southeast Asian Governments and Diplomats

Another Southeast-Asia-focused espionage cluster documented by Kaspersky — a defender research review this week for government and diplomatic entities in the region.

Editorial illustration of a phone lock screen with a gesture sending an SMS past the PIN, marking Google's patch for the Android Gemini lock-screen bug.

Vulnerabilities

Google Publishes Patch for Android Lock Screen Bug That Reportedly Let Gemini Send SMS Without a PIN

A mobile lock-screen bypass involving Gemini — defender verification across managed Android fleets this week.

See all