Research · Cyber threat intelligence
Less noise. More intelligence.
A monthly breakdown of the threat landscape: what happened, why it matters, and what defenders can do about it. Evidence graded, techniques mapped, sources cited.
-
Latest ·
CTI Report — October 2026: Edge Exploits and a $6.3 Billion Heist
The verified record of October 2026: the US$6.3 billion Binance theft and what is and is not confirmed about who did it, all 36 CISA KEV additions led by the Ivanti Connect Secure chain, the IDC Frontier ransomware attack, refrigeration attacks on French supermarkets, large Japanese and Danish breaches, the ARTEX agentic-AI framework, a supply-chain wave, and the month's law-enforcement and policy actions. Every claim is labelled by who confirmed it.
-
Special report ·
Special Report — PHP2Shell: How a Failed Request Poisons the Next One
The full technical and impact report on CVE-2026-109618 and CVE-2026-109619, two critical PHP flaws patched on 21 October: the mechanism explained plainly, why PHP and the researchers describe the two CVEs differently, what each way of running PHP changes, which popular mitigations fail, every exploitation claim graded as evidence or claim, detection and hunting, a patching guide by platform, and the governance and risk view. Ten figures, MITRE ATT&CK mapping and 58 cited sources.
-
CTI Report — September 2026: The Edge Breaks First, and the Agents Are Loose
Full-month assessment built from 340+ public sources: Citrix NetScaler and F5 BIG-IP zero-days with three-day federal deadlines, Microsoft's record 964-CVE Patch Tuesday, 153 million ID scans on a dark-web market, the Pentagon DMDC exposure, the ≈$387.5M Bitget heist, AI agents that escape sandboxes, get hijacked and run intrusions, water and maritime OT attacks, and the EU Cyber Resilience Act reporting clock. Ten charts, MITRE ATT&CK mapping and evidence-graded findings.
-
CTI Report — August 2026: The Compression of the Exploitation Window
Full-month assessment: RansomHub's 90/10 affiliate economics reshaping the ransomware underground, a China-nexus espionage campaign through VMware vCenter exploited five days after patch, the JFrog Artifactory supply-chain crisis, Iranian attacks on UK power and US water infrastructure, the Morocco CNSS breach of ~2 million identities, and OpenAI's and Anthropic's own disclosures of adversarial frontier-model behaviour during testing.
-
CTI Report — July 2026: A Month of Collapsing Patch Windows
Full-month assessment (1–23 July): 15 CISA KEV additions, four exploited SharePoint CVEs using machine-key theft that survives patching, the first documented agentic-AI intrusion of a major AI platform, Iranian PLC attacks causing operational disruption at US water and energy facilities, ransomware and law-enforcement developments. Every finding graded for confidence and evidence status, 75 cited sources, and three corrections to this site's own prior reporting.
Published monthly, with mid-month updates when warranted.