CVE-2026-50328 Windows Server Update Service (WSUS) Tampering Vulnerability
Uncaught exception in Windows Server Update Service allows an unauthorized attacker to perform tampering over a network.
EPSS 0.01 CVE-2026-50328 veřejná správa US
Výsledky hledání
CVE-2026-49178 Windows Active Directory Domain Services Remote Code Execution Vulnerability
Heap-based buffer overflow in Active Directory Domain Services allows an authorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-49178 veřejná správa US
CVE-2026-40378 Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability
Memory allocation with excessive size value in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.
EPSS 0.01 CVE-2026-40378 veřejná správa US
CVE-2026-57976 Windows Active Directory Domain Services Denial of Service Vulnerability
Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network.
EPSS 0.01 CVSS 6.5 CVE-2026-57976 veřejná správa US
CVE-2026-54119 Windows Active Directory Denial of Service Vulnerability
Loop with unreachable exit condition ('infinite loop') in Windows Active Directory allows an unauthorized attacker to deny service over a network.
EPSS 0.01 CVE-2026-54119 veřejná správa US
CVE-2026-55001 Active Directory Domain Services Elevation of Privilege Vulnerability
Improper certificate validation in Windows Active Directory allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-55001 veřejná správa US
CVE-2026-50695 Windows Active Directory Federation Services Denial of Service Vulnerability
Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.
EPSS 0.01 CVE-2026-50695 veřejná správa US
CVE-2026-54983 Windows Active Directory Federation Services Denial of Service Vulnerability
Stack-based buffer overflow in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
EPSS 0.01 CVE-2026-54983 veřejná správa US
CVE-2026-49164 Windows Active Directory Domain Services Remote Code Execution Vulnerability
Heap-based buffer overflow in Active Directory Domain Services allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-49164 veřejná správa US
CVE-2026-50647 Active Directory Federation Server Denial of Service Vulnerability
Loop with unreachable exit condition ('infinite loop') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
EPSS 0.01 CVE-2026-50647 veřejná správa US
CVE-2026-50411 Windows Active Directory Federation Services Denial of Service Vulnerability
Stack-based buffer overflow in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
EPSS 0.01 CVE-2026-50411 veřejná správa US
CVE-2026-50355 Windows Active Directory Federation Services Denial of Service Vulnerability
Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.
EPSS 0.01 CVE-2026-50355 veřejná správa US
CVE-2026-50324 Windows Active Directory Federation Services Denial of Service Vulnerability
Loop with unreachable exit condition ('infinite loop') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
EPSS 0.01 CVE-2026-50324 veřejná správa US
CVE-2026-50368 Windows Active Directory Federation Services Denial of Service Vulnerability
Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.
EPSS 0.01 CVE-2026-50368 veřejná správa US
CVE-2026-50304 Windows Active Directory Federation Services Denial of Service Vulnerability
Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.
EPSS 0.01 CVE-2026-50304 veřejná správa US
CVE-2026-50653 Azure Active Directory Denial of Service Vulnerability
Loop with unreachable exit condition ('infinite loop') in Azure Active Directory allows an unauthorized attacker to deny service over a network.
EPSS 0.01 CVE-2026-50653 veřejná správa US
CVE-2026-50652 Azure Active Directory Denial of Service Vulnerability
Deserialization of untrusted data in Azure Active Directory allows an unauthorized attacker to deny service over a network.
EPSS 0.02 CVE-2026-50652 veřejná správa US
CVE-2026-56197 Windows Admin Center (WAC) Remote Code Execution Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Windows Admin Center allows an authorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-56197 veřejná správa US
AI Security Report 2026
For years, the cyber security industry tracked AI as a force multiplier: something that made existing attack techniques faster, cheaper, and more accessible. That framing was accurate. But the Annual AI Security Report 2026 from Check Point Research documents a transition that goes further. AI has crossed from assistant to operator. Where it once helped attackers prepare, it now runs the operation. Key observed findings AI has crossed from development aid to live attack operator. It now does…
UK and Allies urge critical sectors to improve defences against Russian intelligence targeting
New advisory highlights Russian state cyber actors’ global exploitation of poorly configured routers
One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law Enforcement
Executive Summary SentinelLABS has been tracking sustained cyberespionage activity against several Pakistani law enforcement organizations, taking place from February 2024 to April 2026. All these actors converged on Balochistan Police over this period, bringing both a partner and an adversary of Pakistan to the same police force in a province shaped by a separatist insurgency and the regional tensions it has drawn in. At Balochistan Police, the compromised assets included servers hosting web…
The ‘Ghost’ in the Database: Recovering Active ADFS Signing Keys via Machine DPAPI
Written by: Shebin Mathew Introduction The "Golden SAML" technique, first described by CyberArk researchers in 2017, and further detailed by Mandiant researchers in 2021, remains one of the most effective methods for threat actors to forge identity assertions in the Microsoft ecosystem. By obtaining the private key of an ADFS token-signing certificate, an attacker can authenticate as any user to any SAML-federated application, bypassing multifactor authentication (MFA), conditional access, and…
Cavern Manticore: Exposing Iran-Linked Modular C2 Framework
Note: SysAid was not compromised, and no SysAid vulnerability was involved. The attacker had already gained access to the victim environment and abused a legitimate software-deployment feature to deploy malware onto another machine within it. Key Points Check Point Research (CPR) tracks ‘Cavern Manticore’ as an Iran-nexus threat actor operating against Israeli targets, with a focus on the government and IT sectors. Cavern Manticore shares technical overlaps with other Iranian MOIS (Ministry of…
22nd June – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 22nd June, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Texas Parks and Wildlife Department has been affected by a third-party data breach involving its license system vendor. The incident exposed driver’s license information, passport numbers, emails, phone numbers, and residential addresses for 3,087,721 hunting and fishing license customers. Social Security numbers and payment data were not affected.…
KEV ✓ EPSS 0.96 CVE-2026-20245 CVE-2026-33017 CVE-2026-34908 CVE-2026-34909 CVE-2026-34910 CVE-2026-41947 CVE-2026-41948 CVE-2026-55255 Cisco Ubiquiti Dify Langflow veřejná správa zdravotnictví finance IL
Phishing in the Balkans: Fake Traffic Fines, Real Losses
This blog documents Group-IB’s research into an SMS phishing campaign targeting Serbian road users through the impersonation of Serbia's state road authority, and how it can be linked to both Darcula and Phoenix PhaaS platforms with victims across the globe.
The Bear Necessities: A Look at the Drivers, Dynamics, and Applications of the Pro-Russia Influence Ecosystem
Written by: James Sadowski, Alden Wahlstrom Introduction Four years into Russia’s full-scale invasion of Ukraine, the pro-Russia influence ecosystem has evolved from a tool of war back into a global strategic asset. Since the mobilization of this ecosystem to support frontline objectives, we have witnessed the expedited development of new influence assets linked to multiple, expansive, covert information operations (IO) campaigns and a revitalization of pro-Russia hacktivism at an unprecedented…
STOCKSTAY Another Day: The Latest Addition to Turla’s Intelligence Gathering Apparatus
Written by: Jordan Jones Introduction Google Threat Intelligence Group (GTIG) has conducted an in-depth analysis of a .NET backdoor, tracked as STOCKSTAY, that has been continually developed and deployed by the Russia-linked threat actor Turla (aka SUMMIT, Secret Blizzard, VENOMOUS BEAR, UAC-0194) since at least December 2022. Turla has deployed STOCKSTAY against government and military organizations in Ukraine, as well as entities with an interest in Italian foreign policy. Used for ongoing…
Útočníci získali přístup k desítkám tisíc firewallů Fortinet
Bezpečnostní výzkumníci upozornili na rozsáhlou kampaň zaměřenou na firewally a VPN brány Fortinet, při níž mělo být kompromitováno téměř 74 000 zařízení ve 194 zemích. Útočníci podle zveřejněných informací automatizovaně vyhledávali veřejně dostupná administrační rozhraní, získávali konfigurace zařízení a následně offline prolamovali přístupové údaje. Mezi údajně zasaženými organizacemi jsou nadnárodní společnosti, státní instituce i provozovatelé kritické infrastruktury. Případ zároveň…
Fortinet veřejná správa energetika vodárenství telekomunikace CZ
NCSC CEO: Hostile states linked to three-quarters of cyber attacks affecting UK's critical systems
Dr Richard Horne highlighted the scale of cyber threats against the UK’s critical infrastructure at RUSI’s Annual Security Lecture.
The Devil, Eight Million Emails, and a Whole Lot of Milk | Phishing Stager Exposed
A compromised terminal server became a phishing stager. A fake Boots survey aimed at 8.9 million inboxes, with the payload on a hacked Bolivian government site.
WEBINÁR: Praktické rady k používaniu JISKB (Jednotný informačný systém kybernetickej bezpečnosti)
V súvislosti so zavádzaním požiadaviek projektu NIS2 sme pre vás pripravili dva bezplatné webináre zamerané na praktické používanie JISKB – Jednotného informačného systému kybernetickej bezpečnosti. Počas 90-minútového online stretnutia získate prehľad o práci so systémom a priestor bude aj na vaše otázky. Obsah oboch termínov je rovnaký – vyberte si ten, ktorý vám viac vyhovuje.... The post WEBINÁR: Praktické rady k používaniu JISKB (Jednotný informačný systém kybernetickej bezpečnosti)…
UNC1151/Ghostwriter phishing campaign targeting Gmail accounts
Recently, we have been observing attacks by the UNC1151/Ghostwriter group targeting Gmail accounts. This group has been regularly attacking the mailboxes of Polish citizens for several years, although in the past these attacks focused on other email providers. The techniques used evolve over time, but the core theme of the messages and their objective remain unchanged.
2026-007: Critical Vulnerability in Windows Netlogon
On 12 May 2026, Microsoft published a security advisory addressing a critical vulnerability affecting Windows Server when acting as a domain controller. This vulnerability allows an unauthenticated attacker to execute arbitrary code over a network. According to The Centre for Cybersecurity Belgium (CCB), this vulnerability is currently exploited by threat actors. It is strongly recommended updating affected Windows servers as soon as possible.
CVE-2026-42987 Windows Deployment Services (WDS) Remote Code Execution
Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-42987 veřejná správa US
CVE-2026-45454 Microsoft SharePoint Remote Code Execution Vulnerability
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
EPSS 0.02 CVE-2026-45454 Microsoft veřejná správa finance zdravotnictví školství US
CVE-2026-45648 Windows Active Directory Domain Services Remote Code Execution Vulnerability
Stack-based buffer overflow in Active Directory Domain Services allows an authorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-45648 veřejná správa US
CVE-2026-42980 NT OS Kernel Elevation of Privilege Vulnerability
Integer underflow (wrap or wraparound) in Windows NT OS Kernel allows an authorized attacker to elevate privileges locally.
EPSS 0.07 CVE-2026-42980 veřejná správa US
Útočníci zneužívajú no-code platformu SOFTR na zber prihlasovacích údajov
Varovanie pred phishingovou kampaňou Národné centrum kybernetickej bezpečnosti (NCKB) NBÚ varuje pred rozsiahlou phishingovou kampaňou zameranou primárne na súkromné firmy a štátne inštitúcie. Jej cieľom je vylákať od obetí prihlasovacie údaje k ich e-mailovým schránkam. Predmetná kampaň sa šíri prostredníctvom e-mailov s tematikou upozornení na vypršanie platnosti hesla k poštovej schránke a text správy používateľa vyzýva na reakciu. Útočníci... The post Útočníci zneužívajú no-code platformu…
Old WinRAR Flaw Fuels Attacks on Ukraine: How Unmanaged Software Keeps the Door Open
Two separate Russia-aligned campaigns are still exploiting the WinRAR flaw CVE-2025-8088 against Ukrainian organizations nearly a year after it was patched, showing how unmanaged software keeps an exploited entry point open long after the fix ships.
KEV ✓ · ransomware EPSS 0.94 CVE-2025-8088 WinRAR veřejná správa JP
LABScon25 Replay | Gamaredon x Turla: Unveiling a 2025 Espionage Alliance Targeting Ukraine
In this LABScon 25 presentation, ESET researchers Matthieu Faou and Zoltán Rusnák present the first technical evidence that Gamaredon actively facilitated Turla’s access to high-value Ukrainian targets in Ukraine. Across incidents observed between February and June 2025, Gamaredon tooling, including PteroGraphin and PteroOdd, was used to deploy Turla’s Kazuar backdoor and, in at least one case, restore Turla’s access after the group appeared to have lost its foothold. The talk opens with a…
Why developer machines are now the number one target for supply chain attacks
Teams at Omnea, Cognism, Glasswall, Raisin and the UK public sector reveal why EDR and MDM miss what's really happening on developer machines. Category: News
Pokrenuta kampanja o važnosti prijave kibernetičkih incidenata
CARNET je u suradnji s Nacionalnim centrom za kibernetičku sigurnost (NCSC-HR) i Nacionalnim CERT-om pokrenuo informativnu kampanju s ciljem podizanja svijesti o obvezama koje proizlaze iz Zakona o kibernetičkoj sigurnosti te o važnosti prijave incidenata putem platforme PiXi. Kibernetički napadi postali su svakodnevna prijetnja organizacijama u javnom i privatnom sektoru. Njihove posljedice mogu uključivati financijske gubitke, narušavanje ugleda, prekid poslovanja te ugrožavanje osjetljivih…
Оновлений інструментарій UAC-0057: OYSTERFRESH, OYSTERSHUCK та OYSTERBLUES
Починаючи з весни 2026 року, CERT-UA фіксує численні випадки розсилання електронних листів серед державних організацій із використанням скомпрометованих облікових записів, зокрема із використанням тематики отримання сертифікатів через онлайн-платформу Prometheus.
Upozornění na smishingovou kampaň, ve které se útočníci vydávají za Policii České republiky
Upozorňujeme na smishingovou kampaň, v rámci které se útočníci prostřednictvím SMS zpráv vydávají za Policii České republiky s cílem získat platební údaje obětí.
Continued Evolution of Persistence Mechanism Against Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense
On April 23, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an update to V1: Emergency Directive (ED) 25-03: Identify and Mitigate Potential Compromise of Cisco Devices related to Cisco Secure Firewall Adaptive Security Appliance (ASA) and Cisco Secure Firewall Threat Defense (FTD) products. According to the update, the ArcaneDoor threat actor has developed a previously unknown persistence mechanism that is preserved across upgrading to the fixed releases that…
KEV ✓ EPSS 0.87 CVE-2025-20333 CVE-2025-20362 Cisco veřejná správa US
Upozorenje: u tijeku je SMS prijevara s plaćanjem kazni
Nacionalni CERT zaprimio je niz prijava građana o SMS porukama u kojima ih se lažno obavještava o navodnim prometnim prekršajima i navodi na otvaranje zlonamjernih poveznica te unos osobnih i financijskih podataka. Građani dobivaju SMS poruke u kojima se navodi da je njihovo vozilo evidentirano zbog prekršaja iz Zakona o sigurnosti cestovnog prometa. U poruci se nalazi poveznica za navodno plaćanje kazne koja vodi na lažnu internetsku stranicu, vizualno sličnu Službenom portalu za rješavanje…
Vibe Hacking: Two AI-Augmented Campaigns Target Government and Financial Sectors in Latin America
TrendAI™ Research has identified two emerging threat campaigns—SHADOW-AETHER-040 and SHADOW-AETHER-064—that use agentic AI to drive intrusion operations against government and financial organizations in Latin America, marking these among the first cases we have observed of AI agents executing attacks from initial access to data exfiltration.
Supporting the National Cyber Strategy: How TrendAI™ Helps
A deeper look at the first three pillars and outlining how our capabilities directly support government agencies working to bring this strategy to life.
This month in security with Tony Anscombe – April 2026 edition
Warnings about helpdesk impersonation scams and Iran-linked hackers targeting critical sectors in the US, plus the most damaging scams of 2025 - here's some of what made the headlines this month
Inside Shadow-Earth-053: A China-Aligned Cyberespionage Campaign Against Government and Defense Sectors in Asia
A China-aligned threat group is exploiting unpatched Microsoft Exchange vulnerabilities to conduct cyberespionage against government and critical infrastructure targets across Asia and beyond.
International cyber agencies share fresh advice to defend against China-linked covert networks
New advisory highlights how to defend against attacker tactics believed to be used by China-linked actors to hide malicious cyber activity.
Defending against China-nexus covert networks of compromised devices
Explaining the widespread shift in tactics, techniques and procedures (TTPs) towards networks of compromised infrastructure, and how to defend against it
GopherWhisper: A burrow full of malware
ESET Research has discovered a new China-aligned APT group that we’ve named GopherWhisper, which targets Mongolian governmental institutions
World-first NCSC-engineered device secures vulnerable display links
SilentGlass, a plug-and-play device, actively blocks any unexpected or malicious HDMI and Display Port connections.
Zjednodušené hlášení regulovaných služeb: nově stačí jeden formulář
Zjednodušili jsme proces hlášení a změn regulovaných služeb na Portálu NÚKIB. Nově se všechny úkony provádí prostřednictvím formuláře Ohlášení a správa regulované služby.
Лікарні, органи місцевого самоврядування та оператори FPV - у фокусі кластера кіберзагроз UAC-0247 (UAC-0244)
CERT-UA протягом березня-квітня 2026 року зафіксовано інтенсифікацію кібератак у відношенні органів місцевого самоврядування та, насамперед, комунальних закладів охорони здоров'я, зокрема клінічних лікарень та лікарень екстреної (швидкої) медичної допомоги.
U.S. Public Sector Under Siege: Threat Intelligence for Q1 2026
The first quarter of 2026 has reinforced a hard truth: U.S. government agencies and educational institutions are operating in the most hostile cyber threat environment ever recorded.
The ADWS Architecture That Hides PowerShell AD Enumeration
A threat actor enumerated our entire AD with Get-ADComputer, and none of our detections fired. The problem wasn't their evasion - it was an architectural blind spot in how PowerShell talks to Active Directory.
O365 Device Code Phishing Campaign using EvilTokens and Abusing Railway Platform (Campaign)
A phishing campaign has been reported leveraging the EvilTokens Phishing-as-a-Service platform to target O365 users. The attackers use device code phishing to bypass Multi-Factor Authentication (MFA), and they also utilize Railway to host their malicious infrastructure. The ca...
TrendAI Insight: New U.S. National Cyber Strategy
TrendAI reviews the White House National Cyber Strategy, outlining six pillars to strengthen U.S. cybersecurity—from deterrence and regulation to federal modernization, critical infrastructure protection, AI leadership, and workforce development.