Weekly threat situation reports from OSec (OccamSec).https://www.osec.com/en-ushttps://www.osec.com/resources/threat-briefs/weekly-situation-report-8-3-26/https://www.osec.com/resources/threat-briefs/weekly-situation-report-8-3-26/Security researchers have released a proof-of-concept exploit for CVE-2026-54121, a critical privilege escalation vulnerability in Microsoft's Active Directory Certificate Services. The vulnerability enables attackers to manipulate directory lookup processes to impersonate domain controllers and…Thu, 06 Aug 2026 00:00:00 GMThttps://www.osec.com/resources/threat-briefs/weekly-situation-report-7-27-26/https://www.osec.com/resources/threat-briefs/weekly-situation-report-7-27-26/Ernst & Young (EY) disclosed a breach of a third-party IT support system holding client tax information. An unauthorized party accessed the system between March 28 and April 12, 2026, and downloaded multiple documents. So far, no misuse of the exposed files has been detected.Thu, 30 Jul 2026 00:00:00 GMThttps://www.osec.com/resources/threat-briefs/weekly-situation-report-7-20-26/https://www.osec.com/resources/threat-briefs/weekly-situation-report-7-20-26/A phishing campaign leverages DocuSign lures to automatically download payloads, track user interactions, and install legitimate RMM tools for persistent access.Thu, 23 Jul 2026 00:00:00 GMThttps://www.osec.com/resources/threat-briefs/weekly-situation-report-7-13-26/https://www.osec.com/resources/threat-briefs/weekly-situation-report-7-13-26/A suspected Chinese espionage group used a Roundcube exploit chain to compromise university engineering departments in targeted attacks.; Researchers have demonstrated an offensive technique that recovers active ADFS signing keys using Machine DPAPI, after manual certificate rotation.; A newly…Thu, 16 Jul 2026 00:00:00 GMThttps://www.osec.com/resources/threat-briefs/weekly-situation-report-7-6-26/https://www.osec.com/resources/threat-briefs/weekly-situation-report-7-6-26/A new Citrix NetScaler pre-authentication memory overread vulnerability, dubbed CitrixBleed To Infinity And Beyond (CVE-2026-8451), exposes affected appliances to remote attacks.; A security researcher has released an exploitarium repository containing proof-of-concept exploits for multiple…Thu, 09 Jul 2026 00:00:00 GMThttps://www.osec.com/resources/threat-briefs/weekly-situation-report-6-29-26/https://www.osec.com/resources/threat-briefs/weekly-situation-report-6-29-26/An update to the FortiBleed incident details use of custom tooling used by threat actors in post compromise activities, alongside credential-centric exploitation.; Cisco Unified CM flaw CVE-2026-20230 claimed to be exploited in the wild. Attackers used known unverified and likely fake PoC, while…Thu, 02 Jul 2026 00:00:00 GMThttps://www.osec.com/resources/threat-briefs/weekly-situation-report-6-22-26/https://www.osec.com/resources/threat-briefs/weekly-situation-report-6-22-26/A critical pre-authentication remote code execution vulnerability in Splunk Enterprise (CVE-2026-20253) has left more than 13,000 internet-exposed instances at risk.; A vulnerability in SimpleHelp allows attackers to create unauthorized accounts on affected systems.; The DragonForce ransomware…Thu, 25 Jun 2026 00:00:00 GMThttps://www.osec.com/resources/threat-briefs/weekly-situation-report-6-15-26/https://www.osec.com/resources/threat-briefs/weekly-situation-report-6-15-26/A newly discovered Cisco SD-WAN zero-day vulnerability is actively exploited against enterprise networks; Verdant Panda (UNC5221) deploys multiple backdoors for sustained persistence in targeted intrusions; Nightmare Eclipse researchers unveiled RoguePlanet and greatXML exploits targeting fully…Thu, 18 Jun 2026 00:00:00 GMThttps://www.osec.com/resources/threat-briefs/weekly-situation-report-6-8-26/https://www.osec.com/resources/threat-briefs/weekly-situation-report-6-8-26/A newly discovered CIFSwitch Linux local privilege escalation flaw enables attackers to gain root access across multiple distributions.; Attackers are exploiting a Palo Alto GlobalProtect authentication bypass vulnerability that allows forged cookies to grant unauthorized access.; A Chinese threat…Thu, 11 Jun 2026 00:00:00 GMThttps://www.osec.com/resources/threat-briefs/weekly-situation-report-6-1-26/https://www.osec.com/resources/threat-briefs/weekly-situation-report-6-1-26/SQL injection in Ghost CMS powers large-scale ClickFix malware campaigns; Lazarus APT subgroup introduced fileless remote access trojan for evasion; Nimbus Manticore continues targeting aerospace and technology sectors; cPanel LiteSpeed plugin vulnerability (CVE-2026-48172) actively exploited…Thu, 04 Jun 2026 00:00:00 GMThttps://www.osec.com/resources/threat-briefs/weekly-situation-report-5-25-26/https://www.osec.com/resources/threat-briefs/weekly-situation-report-5-25-26/Nightmare Eclipse disclosed MiniPlasma, a Windows local privilege escalation vulnerability; A public exploit emerged for the DirtyDecrypt Linux root escalation vulnerability; Microsoft warned of an actively exploited Exchange zero-day flaw; FlowerStorm malware uses KrakVM virtual machine framework…Thu, 28 May 2026 00:00:00 GMThttps://www.osec.com/resources/threat-briefs/weekly-situation-report-5-18-26/https://www.osec.com/resources/threat-briefs/weekly-situation-report-5-18-26/Two new Linux local privilege escalation flaws, Dirty Frag and Fragenesia, have been disclosed and may already be under active exploitation.; The Shai-Hulud campaign has compromised additional AI-related packages and released its source code publicly in a move framed as a competition.; A second…Thu, 21 May 2026 00:00:00 GMThttps://www.osec.com/resources/threat-briefs/weekly-situation-report-5-11-26/https://www.osec.com/resources/threat-briefs/weekly-situation-report-5-11-26/A critical buffer overflow vulnerability in PAN-OS is being actively exploited to compromise affected firewall devices.; DAEMON Tools Lite was trojanized in a supply-chain attack to distribute a hidden backdoor to users.; The CloudZ remote access trojan may be stealing one-time passcodes by abusing…Thu, 14 May 2026 00:00:00 GMThttps://www.osec.com/resources/threat-briefs/weekly-situation-report-5-4-26/https://www.osec.com/resources/threat-briefs/weekly-situation-report-5-4-26/SAP-related npm packages have been targeted in the Shai-Hulud supply chain attack to distribute malicious code.; A critical vulnerability in cPanel and WHM is being actively exploited in the wild, with a public proof-of-concept now available.; GlassWorm supply chain attacks have been linked to…Thu, 07 May 2026 00:00:00 GMThttps://www.osec.com/resources/threat-briefs/weekly-situation-report-4-27-26/https://www.osec.com/resources/threat-briefs/weekly-situation-report-4-27-26/Threat actors deploy malicious document sharing and meeting invites as phishing lures to distribute ScreenConnect remote access tool; A Vercel security incident claimed by fake ShinyHunters group resulted in possible supply-chain compromise; CISA issued urgent warnings about critical SD-WAN…Thu, 30 Apr 2026 00:00:00 GMThttps://www.osec.com/resources/threat-briefs/weekly-situation-report-4-20-26/https://www.osec.com/resources/threat-briefs/weekly-situation-report-4-20-26/Multiple vulnerabilities in Adobe Acrobat are being actively exploited in real-world attacks.; Hackers are conducting sophisticated remote access campaigns to infiltrate shipping systems and steal cargo.; An impersonator posing as a Linux Foundation leader is using Slack messages to phish…Thu, 23 Apr 2026 00:00:00 GMThttps://www.osec.com/resources/threat-briefs/weekly-situation-report-4-13-26/https://www.osec.com/resources/threat-briefs/weekly-situation-report-4-13-26/Iranian-linked hackers are targeting critical infrastructure and exposed operational technology (OT) systems in ongoing campaigns.; Attackers are exploiting a vulnerability in the Ninja Forms plugin that leaves WordPress sites vulnerable to full takeover.; AI-driven Microsoft device code phishing…Thu, 16 Apr 2026 00:00:00 GMThttps://www.osec.com/resources/threat-briefs/weekly-situation-report-4-6-26/https://www.osec.com/resources/threat-briefs/weekly-situation-report-4-6-26/A critical memory overread vulnerability in Citrix NetScaler is actively exploited in real-world attacks; Hackers target a critical F5 BIG-IP vulnerability for unauthorized system access; North Korean state-linked threat group attributed to axios supply chain attack; Cisco source code stolen…Thu, 09 Apr 2026 00:00:00 GMThttps://www.osec.com/resources/threat-briefs/weekly-situation-report-3-30-26/https://www.osec.com/resources/threat-briefs/weekly-situation-report-3-30-26/A critical Oracle Identity Manager vulnerability (CVE-2026-21992) enables remote code execution on affected systems.; TEAMPCP supply chain attacks are escalating following the compromise of a security tool used in development environments.; Attackers are abusing Microsoft Azure Monitor alerts to…Thu, 02 Apr 2026 00:00:00 GMThttps://www.osec.com/resources/threat-briefs/weekly-situation-report-3-23-26/https://www.osec.com/resources/threat-briefs/weekly-situation-report-3-23-26/A critical Telnet vulnerability affecting all versions has been disclosed, with no patch expected until April 1st.; The LeakNet ransomware group is using ClickFix techniques and the Deno runtime to conduct stealthy intrusions.; The ForceMemo campaign has compromised Python repositories in the…Thu, 26 Mar 2026 00:00:00 GMThttps://www.osec.com/resources/threat-briefs/weekly-situation-report-3-16-26/https://www.osec.com/resources/threat-briefs/weekly-situation-report-3-16-26/Storm-2561 distributes trojanized software via SEO poisoning to deceive victims into downloading malware; A newly demonstrated Zombie ZIP technique is expected to be adopted by threat actors for evasion and detection bypass; The BlackSanta campaign uses an EDR-killer tool targeting HR departments…Fri, 20 Mar 2026 00:00:00 GMThttps://www.osec.com/resources/threat-briefs/weekly-situation-report-3-9-26/https://www.osec.com/resources/threat-briefs/weekly-situation-report-3-9-26/VMware released patches for remote code execution vulnerabilities in Aria Operations allowing complete system compromise; Iranian-linked attacks targeted internet-connected IP cameras, likely involving state actors and affiliated groups; APT28 exploited MSHTML vulnerability CVE-2026-21513 as a…Thu, 12 Mar 2026 00:00:00 GMThttps://www.osec.com/resources/threat-briefs/weekly-situation-report-3-2-26/https://www.osec.com/resources/threat-briefs/weekly-situation-report-3-2-26/Critical vulnerabilities in SolarWinds Serv-U can grant attackers root-level access to affected servers; The 'Starkiller' phishing service uses realistic login pages and MFA bypass techniques to steal credentials; VMware has released fixes for remote code execution vulnerabilities in Aria…Thu, 05 Mar 2026 00:00:00 GMThttps://www.osec.com/resources/threat-briefs/weekly-situation-report-2-23-26/https://www.osec.com/resources/threat-briefs/weekly-situation-report-2-23-26/Chinese state-sponsored actors have exploited a hardcoded credential vulnerability in Dell RecoverPoint for Virtual Machines since mid-2024, deploying two malware families (Brickstorm and its successor Grimbolt) to maintain persistent backdoors and pivot laterally through victim networks.Thu, 26 Feb 2026 00:00:00 GMT