CrowdStrike: Vapor Panda used ARTEX against over 200 organizations
From October 17 the China-linked group hit ministries, telecoms, and U.S. defense-related targets; post-exploitation is confirmed at nine.
86
Organization
Trend Micro
- Mentions · 7d9
- Mentions · 30d20
- All mentions25
- First seenAug 15, 2026
- Last mentioned15h ago
Timeline
25 articles · newest firstResearcher claims new zero-click Telegram sticker bugs can run code on iOS
Aziz says logic flaws bypass server checks Telegram cited against rlottie bug CVE-2026-111105; no public proof or patch.
64
Researchers say Discover-Tech ads may track Starlink users
TrendAI says codename SHADOW-EARTH-79 won about 13% of observed Starlink ad bids and was the top bidder in 105 countries.
58
ESET reviews a week of PHP, kernel, and LiteLLM incidents
PHP fixes shipped October 21; nine firms, including ESET, told NBC News they had seen no successful PHP2Shell attacks.
58
Trend Micro: three Japan-focused attacks used AI to different degrees
Only one case was confirmed as agent-driven; entry often used exposed legacy systems and default or reused credentials.
72
GMO tells Onamae.com users to shut down PCs after extortion threat
Attackers demanded about ¥8 billion; alleged data appeared online, but GMO has not confirmed ransomware.
74
GMO urges Onamae customers to shut down PCs over ransomware threat
GMO says data was posted after an October 20 intrusion that may have hit 26,739 servers; it refused an ¥8 billion ransom and says encryption did not run.
74
CyberStrikeAI’s 44 agents automated attacks on Japan organizations
Other listed targets included Taiwan, Hong Kong, the UK, France, Italy, Qatar, and Colombia.
74
Discover-Tech accused of tracking Starlink users through online ads
TrendAI found one bidder dominating sampled Starlink ad auctions in 105 countries; the work does not show infection or a Starlink breach.
62
Unpatched Linux KSMBD flaws disclosed, including two remote code execution bugs
Neither CVSS 9.0 KSMBD issue had a CVE or a mainline fix as of October 23, 2026.
74
Unpatched Linux KSMBD flaws rated CVSS 9.0 posted before fixes
ZDI reports describe remote code execution in the kernel SMB server; no CVE or mainline fix is named.
76
pwn.watch lists GitLab RCE, leaked kernel bugs and LiteLLM compromise
The same live feed also covers BIND GSS-TSIG memory corruption, Node.js security releases, bank AI-agent logins and a Railway environment-variable incident.
68
Japan cyber incident reports rose 48% in Q3 2026
Insikt Group counted 918 reports, up from 621, alongside multi-million-record breaches and an IDCFrontier ransomware outage.
78
Hackers get $1,262,000 for 98 zero-days at Pwn2Own Ireland
Pwn2Own Ireland 2026 paid $1,262,000 for 98 zero-days, including Galaxy S26, Pixel 10, and OpenAI Codex.
71
PoC Exploit Released for Critical VMware Vulnerability Enabling Guest-to-Host Attacks
Public PoC for CVE-2026-59346 crashes VMware Workstation and Fusion through a guest-to-host integer overflow.
66
SonicWall’s latest critical flaw indicates a security pattern, not another one-off bug
SonicWall disclosed a CVSS 10 pre-auth SSRF in SMA1000, with no confirmed exploitation yet.
82
SonicWall Patches CVSS 10.0 Pre-Authentication SSRF Flaw in SMA1000 Appliances
SonicWall patched a CVSS 10.0 pre-auth SSRF in SMA1000 WorkPlace plus three authenticated flaws.
74
SonicWall Patches 4 SMA1000 Flaws, Including Critical Pre-Auth SSRF Rated CVSS 10
SonicWall patched four SMA 1000 flaws, including an unauthenticated SSRF rated CVSS 10.0.
68
Hackers exploit 32 zero-days on first day of Pwn2Own Ireland
Researchers exploited 32 zero-days for $388,500 on day one of Pwn2Own Ireland, hacking Samsung Galaxy S26 twice and Oracle's AI database.
58
Pwn2Own Ireland 2026 - Day One Results
Pwn2Own Ireland 2026 day one: Ikotas Labs failed to exploit a Brother printer in time.
28
DarkMe RAT trades zero-days for plain phishing emails
The DarkMe RAT has shifted from using zero-day exploits to simple phishing emails, targeting corporate users to steal cryptocurrency and credentials.
55
[object Object]
The DarkMe malware is now being delivered via simple phishing emails, abandoning the zero-days previously used to deliver the payload.
72
Zero Day Initiative — CVE-2026-33824: Remote Code Execution in Windows ...
ZDI details CVE-2026-33824, a double-free in Windows IKEv2 fragment reassembly enabling unauthenticated remote code execution as SYSTEM on Windows.
65
Mustang Panda Upgrades CoolClient With a Kernel Rootkit
Mustang Panda's updated CoolClient backdoor deploys a signed kernel driver to hide processes, files and network activity in Asian intrusions.
62
China-Linked Jewelbug Uses XG-Web for Government Espionage and Crypto Fraud
China-linked Jewelbug runs government espionage and crypto fraud from a single XG-Web browser-based control framework.
76
Related CVEs
by mentions- CVE-2026-835488%10.0Pre-Authentication SSRF in SonicWall SMA1000 Appliance Workplace Interface
- CVE-2026-8354910%7.8Authenticated OS Command Injection RCE in SonicWall SMA1000 Appliance Console
- CVE-2026-102255<1%10.0Pre-auth SSRF in SonicWall SMA1000 Work Place interface
- Authenticated OS command injection in SonicWall SMA1000
- Zip Slip RCE in SonicWall SMA 1000 AMC
- Stored XSS in SonicWall SMA 1000 Management Console
- CVE-2026-154097%10.0Unauthenticated SSRF in SonicWall SMA1000 Appliances
- CVE-2026-3382477%9.8Unauthenticated Double-Free RCE in Microsoft Windows IKE Extension
- CVE-2026-11149783%9.2Buffer overflow in Google Brotli decoder 1.0.3–1.2.0
- CVE-2025-412362%9.3VMware ESXi, Workstation, and Fusion contain an integer-overflow vulnerability in the VMXNET3 virtual network adapter
Appears with
- Zero Day Initiativeorganization · 11
- Linux kernelproduct · 4
- Ikotas Labsorganization · 3
- ksmbdproduct · 3
- Anthropicorganization · 3
- SonicWallorganization · 3
- SonicWallvendor · 3
- Yamahavendor · 2
- Comcastorganization · 2
- TrendAIorganization · 2
- Starlinkproduct · 2
- Oraclevendor · 2
- DarkMemalware · 2
- Microsoftvendor · 2
- Appliance Management Consoleproduct · 2
- WorkPlaceproduct · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.