PHP "php2shell" flaws now exploited, CISA sets a three-day deadline
CISA moved both php2shell PHP flaws into its KEV catalog on 26 October, giving federal agencies until 29 October to patch and to check for prior compromise.
Read the analysisExploited Nextcloud CODE server and VeloCloud flaws get 3-day KEV deadline
CISA listed an exploited command injection in the Collabora CODE app for Nextcloud and a VeloCloud Orchestrator SQL injection, both due 26 October with triage.
AdvisoryTwo critical PHP flaws could allow unauthenticated code execution
CISA, the UK NCSC and the FBI urge immediate patching of two critical PHP core flaws that could allow remote code execution on web-facing servers.
Active exploitationExploited Zammad helpdesk chain runs from session hijack to root
CISA added two chained Zammad flaws to its KEV catalog: a session hijack giving code execution and a local root escalation, with a 5 October federal deadline.
Law enforcementTwo get 189 months combined for US business email wire-fraud scheme
Two Delaware men who phished business mailboxes and redirected wires, including a $1.68M payment, got 189 months combined. What finance teams should change.
Active exploitationExploited FortiMail flaw lets attackers write files with no fix out yet
CISA added an unauthenticated FortiMail path traversal to its KEV catalog with a three-day deadline and a compromise check, while fixed builds are still pending.
Active exploitationApple CoreGraphics zero-day exploited in targeted attacks, CISA says
CISA added an Apple CoreGraphics memory flaw to its KEV catalog after reports of targeted attacks, with a 2 October deadline and forensic triage for iOS and macOS.
Active exploitationExploited Cisco SD-WAN Manager flaw gives attackers admin API access
CISA added a critical Cisco Catalyst SD-WAN Manager authentication bypass to its KEV catalog with a three-day federal deadline and a required compromise check.
Active exploitationTwo Citrix NetScaler zero-days under active attack, CISA and NCSC warn
CISA and the UK NCSC confirm attackers are exploiting two critical NetScaler ADC and Gateway flaws as zero-days. Check for compromise, then patch by 30 September.
Active exploitationCISA confirms exploitation of SharePoint and MikroTik RouterOS flaws
CISA added a SharePoint code injection flaw and a MikroTik RouterOS SSH bug that completes a known router takeover chain to KEV, with a 28 September deadline.
Active exploitationCISA flags six exploited flaws in VPN, SD-WAN and commerce platforms
CISA added six actively exploited CVEs in Check Point, F5 BIG-IP APM, Arista VeloCloud, WSO2 and Adobe Commerce to KEV this week, with deadlines of 25 and 27 September.
Active exploitationCISA confirms attacks on WordPress core file inclusion flaw
CISA added a WordPress core file inclusion bug that can lead to code execution to its KEV catalog, set a three-day federal deadline and required forensic triage.
AdvisoryFBI and CISA warn ICS integrators are a path into critical infrastructure
An FBI and CISA fact sheet cites an intrusion at a US industrial automation integrator where attackers packaged about 800 files, including customer SCADA data.
Threat landscape
APT28
State-sponsored APT group targeting NATO-aligned governments, defense contractors, and critical infrastructure.
APT29
Threat group attributed by MITRE ATT&CK to Russia's Foreign Intelligence Service (SVR), active since at least 2008 and linked to the 2015-16 DNC compromise and the 2020 SolarWinds supply-chain attack.
APT32
Suspected Vietnam-based threat group, per MITRE ATT&CK, active since at least 2014, targeting private industry, foreign governments, dissidents, and journalists across Southeast Asia.
APT41
Chinese state-sponsored espionage group, per MITRE ATT&CK, that also conducts financially motivated operations, active since at least 2012 across 14 countries and multiple industries.
Kimsuky
North Korea-based cyber espionage group active since at least 2012, per MITRE ATT&CK, focused on foreign policy and nuclear-policy intelligence collection tied to the Korean Peninsula.
Lazarus Group
North Korean state-sponsored threat group attributed by MITRE ATT&CK to the Reconnaissance General Bureau (RGB), active since at least 2009 and linked to the 2014 Sony Pictures wiper attack.
Mustang Panda
China-based cyber espionage actor, per MITRE ATT&CK, conducting operations since at least 2012 using tailored phishing lures against government, diplomatic, and NGO targets.
OilRig
Suspected Iranian threat group, per MITRE ATT&CK, targeting Middle Eastern and international victims since at least 2014 via supply-chain trust relationships.
Sandworm Team
Destructive threat group attributed by MITRE ATT&CK to Russia's GRU military unit 74455, active since at least 2009 and linked to Ukrainian power-grid attacks and the 2017 NotPetya worm.
Turla
Cyber espionage group attributed by MITRE ATT&CK to Russia's Federal Security Service (FSB), active since at least 2004 with victims in over 50 countries.
Volt Typhoon
PRC state-sponsored actor, per MITRE ATT&CK, active since at least 2021, pre-positioning within US critical infrastructure using living-off-the-land techniques rather than custom malware.
-
CRITICAL
Arista VeloCloud OrchestratorOn-Prem Input Validation Flaw (CVE-2026-93952)
CVE-2026-93952 is a CVSS 10.0 input-validation flaw in on-prem Arista VeloCloud Orchestrator, added to CISA's KEV catalog as exploited on September 22, 2026.
-
CRITICAL2 CVEs: Check Point Quantum Security Gateway & Check Point Quantum Security Management (CVE-2026-85102)
Two CVSS 9.8 Check Point flaws, a VPN-negotiation RCE in Quantum Security Gateway and a pre-auth upload bug in Management, were CISA KEV-listed September 22.
-
CRITICALF5 BIG-IP APM Vulnerability (CVE-2026-94127)
CVE-2026-94127 is a CVSS 9.8 heap overflow in F5 BIG-IP APM enabling unauthenticated RCE when APM acts as an OAuth Authorization Server; CISA KEV-listed.
-
CRITICAL
ACPT- Custom Post Types Plugin for WordPress Privilege Escalation (CVE-2026-32566)
CVE-2026-32566 is a CVSS 9.8 unauthenticated privilege escalation flaw in the ACPT Pro WordPress plugin, reported exploited by VulnCheck KEV.
-
HIGHAcronis Backup plugin for cPanel & WHM Privilege Escalation (CVE-2026-87886)
CVE-2026-87886 is a CVSS 7.8 local privilege escalation in Acronis Backup control-panel plugins, confirmed exploited per CISA KEV.
Active campaigns
SharePoint ToolShell Exploitation
July 2025 exploitation campaign against on-premises Microsoft SharePoint servers via incompletely patched spoofing and RCE vulnerabilities, later reissued as CVE-2025-53770/53771, exploited by a ransomware actor and two espionage groups.
2025 Poland Wiper Attacks
Russian state-sponsored destructive campaign against Polish energy infrastructure in December 2025, deploying two previously undocumented wiper tools against wind, photovoltaic, and CHP facilities.
Operation AkaiRyū
Cyberespionage spearphishing campaign conducted by MirrorFace against entities in Japan and Central Europe, notable as the group's first reported targeting of a European entity and its first use of the UPPERCUT malware.
Cutting Edge
Campaign by suspected China-nexus espionage actors exploiting zero-day vulnerabilities in Ivanti Connect Secure VPN appliances beginning December 2023, targeting the US defense industrial base and multiple global sectors.
APT41 DUST
APT41's use of DUSTPAN and the newly observed DUSTTRAP malware, alongside Cobalt Strike and certutil, against shipping, logistics, and media entities in Europe, Asia, and the Middle East from 2023 to mid-2024.
KV Botnet Activity
Volt Typhoon's exploitation of end-of-life SOHO routers from Cisco, NETGEAR, and DrayTek to obfuscate connectivity to US critical infrastructure victims, disrupted by US law enforcement in early 2024.
APT28 Nearest Neighbor Campaign
APT28's use of Wi-Fi daisy-chaining across nearby compromised organizations, combined with zero-day exploitation of CVE-2022-38028, to reach organizations and individuals with Ukraine expertise, February 2022 to November 2024.
Operation CuckooBees
Cyber espionage campaign targeting technology and manufacturing companies in East Asia, Western Europe, and North America since at least 2019, assessed by researchers as conducted by actors affiliated with Winnti Group, APT41, and BARIUM.
Operation Dream Job
Cyber espionage operation likely conducted by Lazarus Group using fake job lures against defense, aerospace, and government sectors in the US, Israel, Australia, Russia, and India, 2019-2020.
SolarWinds Compromise
Sophisticated supply-chain cyber operation conducted by APT29, discovered mid-December 2020, that injected malicious code into the SolarWinds Orion software build process and was formally attributed to Russia's SVR in April 2021.
Operation Wocao
Cyber espionage campaign by suspected China-based actors, per MITRE ATT&CK, that compromised government organizations, managed service providers, and multiple industries across ten countries from late 2017 to late 2019.
Operation Honeybee
Campaign targeting humanitarian aid and inter-Korean affairs organizations from late 2017 through early 2018, initially in South Korea before expanding to six additional countries, assessed as likely Korean-speaking actors.
2016 Ukraine Electric Power Attack
Sandworm Team's use of Industroyer malware to target and disrupt distribution substations within the Ukrainian power grid in December 2016, the second major public attack Sandworm Team conducted against Ukraine.
2015 Ukraine Electric Power Attack
Sandworm Team's use of BlackEnergy3 and KillDisk to disrupt transmission and distribution substations within the Ukrainian power grid in December 2015 — the first major public cyberattack on a power grid.
Night Dragon
Cyber espionage campaign targeting oil, energy, and petrochemical companies and executives in Kazakhstan, Taiwan, Greece, and the United States, collecting SCADA and production data, assessed as China-based.
Tactics & techniques
Emerging threats
No unconfirmed or early-stage signals published yet.
7 Most Dangerous State-Sponsored Hacker Groups Targeting the U.S.
Seven state-sponsored hacker groups U.S. government advisories most frequently name as active threats — with DOJ, CISA, and Treasury attribution for each.
Best Threat Intelligence Platforms for Small Security Teams
For a small security team, the best threat intelligence platform is the one built on authoritative NVD and CISA KEV data, not the biggest vendor feed.
CISA Advisory Explained: A Guide for Security Teams
How CISA cybersecurity advisories are structured, who co-authors them, and how they differ from a vendor advisory or the CISA KEV catalog.
How to Choose a Threat Intel Platform When Your SOC Team Is Small
A framework for choosing a threat intelligence platform when your SOC is small, using NVD and CISA KEV as the baseline every option should be measured against.
How to Respond to a CISA Advisory Before Attackers Strike
A step-by-step response process for a new CISA advisory or KEV catalog addition, sized for a team without a dedicated intel analyst.
Two MikroTik RouterOS Flaws Added to CISA KEV List
CISA added two MikroTik RouterOS flaws, CVE-2026-86060 (CVSS 9.8) and CVE-2026-67277 (CVSS 8.2), to its KEV catalog Sept. 10, 2026 as actively exploited.
Microsoft Patch Tuesday December 2025: 58 CVEs, 1 Exploited
Microsoft's December 9, 2025 Patch Tuesday fixed 58 Microsoft CVEs, 2 critical, of 156 listed. Exploited at release: CVE-2025-62221; 2 publicly disclosed.
Microsoft Patch Tuesday November 2025: 63 CVEs, 1 Exploited
Microsoft's November 11, 2025 Patch Tuesday fixed 63 Microsoft CVEs (5 critical) of 85 entries listed that day. Exploited at release: CVE-2025-62215.
Microsoft Patch Tuesday October 2025: 175 CVEs, 3 Exploited
Microsoft's October 14, 2025 Patch Tuesday fixed 175 Microsoft CVEs, 15 critical, of 252 listed. 3 were exploited at release; 3 publicly disclosed.
Microsoft Patch Tuesday April 2026: 172 CVEs, 2 Exploited
Microsoft's April 14, 2026 Patch Tuesday fixed 172 Microsoft CVEs, 15 critical. Exploited at release: CVE-2026-32201, CVE-2026-32202; 1 publicly disclosed.
Microsoft Patch Tuesday August 2026: 422 CVEs, 1 Exploited
Microsoft's August 11, 2026 Patch Tuesday fixed 422 Microsoft CVEs, 64 critical, of 779 listed. Exploited at release: CVE-2026-68820; 2 publicly disclosed.
Microsoft Patch Tuesday February 2026: 58 CVEs, 6 Exploited
Microsoft's February 10, 2026 Patch Tuesday fixed 58 Microsoft CVEs (5 critical) of 61 entries listed that day. 6 were exploited at release.
Microsoft Patch Tuesday January 2026: 112 CVEs, 1 Exploited
Microsoft's January 13, 2026 Patch Tuesday fixed 112 Microsoft CVEs, 8 critical, of 146 listed. Exploited at release: CVE-2026-20805; 2 publicly disclosed.
Microsoft Patch Tuesday July 2026: 622 CVEs, 3 Exploited
Microsoft's July 14, 2026 Patch Tuesday fixed 622 Microsoft CVEs, 61 critical, of 1,131 listed. 3 were exploited at release; 1 publicly disclosed.
Microsoft Patch Tuesday June 2026: 207 CVEs, 38 Critical
Microsoft's June 9, 2026 Patch Tuesday fixed 207 Microsoft CVEs, 38 critical. None marked exploited at release; 2 others flagged; 3 disclosed.
Microsoft Patch Tuesday March 2026: 83 CVEs, 8 Critical
Microsoft's March 10, 2026 Patch Tuesday fixed 83 Microsoft CVEs, 8 critical. None marked exploited at release; 2 others flagged; 2 disclosed.
Microsoft Patch Tuesday May 2026: 137 CVEs, 30 Critical
Microsoft's May 12, 2026 Patch Tuesday fixed 137 Microsoft CVEs, 30 critical. None was marked exploited at release; 4 other entries are flagged exploited.
Microsoft Patch Tuesday Sep 2026: 973 CVEs, 2 Exploited
Microsoft's September 8, 2026 Patch Tuesday fixed 973 Microsoft CVEs, 113 critical, of 1,181 listed. Exploited at release: CVE-2026-81963, CVE-2026-85880.
State-Sponsored Hackers: Tactics, Targets & How to Defend Against Them
The common tactics, sectors, and defense strategies documented in CISA advisories on state-sponsored hackers, mapped to MITRE ATT&CK and real CVE data.
Top CTI Tools Built for Small Security Teams in 2026
A shortlist of free, authoritative CTI resources for small security teams in 2026 — NVD, CISA KEV, MITRE ATT&CK, and analyst tools built on top of them.
What Is a CISA Advisory and Why Should You Act on It?
What a CISA advisory actually is, the different types CISA publishes, and why security teams should treat them as a priority signal, not just another alert.
Who Are State-Sponsored Hackers? A Complete Guide
What state-sponsored hackers are, which governments run them, their motivations, and how they differ from cybercriminals — grounded in DOJ, CISA, and MITRE ATT&CK.