Volt Typhoon rebuilt Silent Train relay chains since late 2023
Black Lotus Labs says chains were rebuilt in under two minutes and hundreds of victims were notified.
84
- Mentions · 7d5
- Mentions · 30d16
- All mentions43
- First seenAug 19, 2026
- Last mentioned2d ago
Timeline
43 articles · newest firstEclypsium report details exploited flaws in firewalls, VPNs and network appliances
InfraTrust tracked 133 new advisories covering 2,813 vulnerabilities in a month; 16 advisories involved actively exploited KEV-listed flaws.
90
Trend Micro: three Japan-focused attacks used AI to different degrees
Only one case was confirmed as agent-driven; entry often used exposed legacy systems and default or reused credentials.
72
AI-assisted intruders target Japanese firms and steal credentials
TrendAI reconstructed three infrastructures; the deepest access used exposed admin panels and stolen or default credentials.
68
CyberStrikeAI’s 44 agents automated attacks on Japan organizations
Other listed targets included Taiwan, Hong Kong, the UK, France, Italy, Qatar, and Colombia.
74
Open source nginx before 1.31.7 or 1.30.6 may allow RCE
An oss-security post says at least two F5-published nginx issues may allow remote code execution.
72
F5 ships emergency patches for three critical NGINX flaws
All three CVEs score 9.2; F5 says it has found no evidence of exploitation and urges upgrades.
76
F5 ships out-of-band patches for critical NGINX flaws
Three critical bugs can crash NGINX or, if ASLR is off or bypassed, allow code execution; F5 reports no exploitation.
78
F5 addressed critical RCE flaws in NGINX
F5 patched three critical NGINX flaws that can allow unauthenticated remote code execution.
76
F5, Juniper Networks Patch Critical Vulnerabilities
F5 and Juniper patched critical NGINX and Junos flaws that can lead to remote code execution.
72
F5 security advisory (AV26-1049)
Canada’s Cyber Centre urges updates for multiple NGINX and F5 products affected by three new CVEs.
38
NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks
NGINX 1.30.6 and 1.31.7 fix five flaws, including possible worker RCE and a TLS client-cert bypass.
76
Growing PQC at the edge belies deeper quantum-readiness challenges
F5 Labs says 54% of top sites offer post-quantum key exchange, but CDN defaults inflate true enterprise readiness.
52
Top 10 Best API Security Tools in 2026 [Ranked & Scored]
Salt Security tops a 2026 API security ranking, ahead of Traceable and Akamai’s Noname.
22
Cyber guardrails tax the defender, not the attacker
Winfunc says AI cyber guardrails hinder defenders after an unguarded agent breached Hugging Face in July.
68
Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes
CISA added exploited FortiMail flaw CVE-2026-104286, a critical unauthenticated file-write bug, to the KEV catalog.
86
Week in review: Gyazo breach exposes 23.6M user data, TASK#STOMP steals documents
Weekly roundup leads with a Gyazo breach of 23.6 million users and the TASK#STOMP document-stealing backdoor.
80
CVE-2026-94127: F5 BIG-IP APM RCE Under Active Exploitation
F5 shipped emergency fixes for CVE-2026-94127, a critical BIG-IP APM flaw under active exploitation.
86
Check Point hacked: The security software protecting your network has become a prime attack target
Attackers are exploiting two pre-authentication Check Point firewall flaws rated CVSS 9.8.
85
F5 BIG-IP APM Zero-Day Exploited in Zero-Day RCE Attacks
Attackers are exploiting critical F5 BIG-IP APM zero-day CVE-2026-94127 for unauthenticated remote code execution.
88
Someone's attacking a critical 0-day RCE in F5 BIG-IP APM
Attackers are exploiting critical F5 BIG-IP APM zero-day CVE-2026-94127; CISA added it to KEV.
87
CVE-2026-94127: Critical Unauthenticated RCE in F5 BIG-IP APM
F5 patches critical CVSS 9.8 heap-based buffer overflow (CVE-2026-94127) in BIG-IP APM that allows unauthenticated RCE, now added to CISA KEV list.
90
F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers
F5 patches actively exploited critical zero-day (CVE-2026-94127) in BIG-IP APM OAuth servers, enabling unauthenticated remote code execution.
95
Critical F5 BIG-IP Vulnerability Exploited as Zero-Day
F5 and CISA warned of an actively exploited critical zero-day (CVE-2026-94127) in BIG-IP APM enabling unauthenticated remote code execution.
95
Critical F5 BIG-IP APM Flaw Actively Exploited for Remote Code Execution
F5 says CVE-2026-94127, a critical unauthenticated BIG-IP APM RCE, is already exploited in the wild.
88
Hackers Exploiting F5 BIG-IP OAuth Server 0-day Flaw to Gain Remote Code Execution
Attackers are exploiting F5 BIG-IP APM OAuth zero-day CVE-2026-94127 for unauthenticated remote code execution.
87
F5 security advisory (AV26-949)
Canada's Cyber Centre warns F5 BIG-IP APM flaw CVE-2026-94127 is being exploited in the wild.
82
CISA Adds Four Known Exploited Vulnerabilities to Catalog
CISA added four actively exploited Check Point, Arista VeloCloud, and F5 BIG-IP flaws to the KEV catalog.
80
2026-013: Critical Vulnerability in F5 BIG-IP APM
CERT-EU says exploited F5 BIG-IP APM flaw CVE-2026-94127 allows unauthenticated remote code execution.
86
16 governance tools for securing your AI fleet
CSO Online reviews 16 AI governance and security tools, including Collibra, Credo AI, F5/CalypsoAI, Fiddler AI, and Guardrails AI, for managing LLM risks.
28
Stealth rootkit targeting F5 BIG-IP could expose enterprise identity gateways
Sophos analyzed a stealth Linux rootkit that hides a web shell in memory on compromised F5 BIG-IP APM identity gateways, evading file-based detection.
72
Hackers deploy Linux rootkit on F5 BIG-IP APM devices, hiding web shell in memory
Sophos analyzed a Linux rootkit, tracked as PoisonedRefresh, on hacked F5 BIG-IP APM devices hiding an in-memory web shell linked to exploited CVE-2025-53521.
78
PoisonedRefresh: A Fileless Linux Rootkit That Injects PHP Web Shells Into F5 BIG-IP APM Server Memory
Sophos details PoisonedRefresh, a fileless Linux rootkit that injects a memory-resident PHP web shell into F5 BIG-IP APM after exploitation of CVE-2025-53521.
78
F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans
Sophos found F5 BIG-IP APM malware that injects a PHP web shell into Apache's memory, evading disk scans, linked to exploited CVE-2025-53521.
72
Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit
Sophos analyzed a Linux rootkit on F5 BIG-IP APM devices that injects a fileless PHP web shell, likely after CVE-2025-53521 exploitation.
76
F5 security advisory (AV26-878)
Canada's Cyber Centre relayed an F5 advisory (AV26-878) covering vulnerabilities in BIG-IP, BIG-IQ, NGINX components, and APM clients.
28
FBI Disrupts China-Linked QTFY Infrastructure Used to Steal Data From U.S. Organizations
FBI and Lumen disrupted QTFY's QScan and QTRouter botnet platforms used by Chinese state-sponsored hackers to conceal intrusions into U.S. agencies.
78
F5 speeds up virtual patching to counter AI-driven threats
F5 added anomaly detection and agentic threat intelligence to its AI-powered WAF, enabling virtual patch enforcement against exploits within minutes.
30
New infosec products of the month: August 2026
August 2026 roundup of security product releases from ServiceNow, Tanium, Snyk, F5, A10, Searchlight Cyber, Intezer, NETSCOUT, Tufin, and Abnormal AI.
16
Officials disrupt Chinese espionage operation that hit multiple federal agencies
FBI and DOJ seized QTFY infrastructure, disrupting a Chinese state-sponsored group that compromised federal agencies and critical infrastructure since 2018.
88
Related CVEs
by mentions- CVE-2026-9412725%9.3Unauthenticated Heap-Overflow RCE in F5 BIG-IP APM with OAuth Profile
- CVE-2026-15176<1%9.2NGINX heap overflow via alias and $request_filename
- Heap buffer overflow in NGINX map regex handling
- CVE-2026-9361692%9.8Unauthenticated RCE in Check Point Management Server via Directory Traversal and File Upload
- CVE-2025-535212%9.3Stack-Based Buffer Overflow in F5 BIG-IP APM Enables Unauthenticated RCE
- CVE-2026-97205<1%9.2Use-after-free in NGINX when AIO and SSI are enabled
- CVE-2026-8510254%9.8Unauthenticated RCE in Check Point Quantum Security Gateway via certificate flaw
- CVE-2026-939521%9.5Unauthenticated Input-Validation Flaw in VeloCloud Orchestrator (On-Prem)
- CVE-2026-1042865%9.8Unauthenticated path traversal file write in Fortinet FortiMail
- CVE-2026-8877182%9.5Unauthenticated RCE in Citrix NetScaler ADC and Gateway
Appears with
- CISAorganization · 12
- F5organization · 12
- BIG-IP APMproduct · 11
- Check Pointvendor · 9
- BIG-IPproduct · 8
- Citrixvendor · 8
- Ciscovendor · 6
- Fortinetvendor · 6
- nginxproduct · 5
- Sophosvendor · 5
- Ivantivendor · 4
- F5 BIG-IP APMproduct · 4
- FBIorganization · 4
- PoisonedRefreshmalware · 4
- ESETvendor · 4
- NGINX Plusproduct · 4
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.