Phishing Pages Are Becoming Live Operator Consoles.
JWR combines 44 phishing pages with an encrypted WebSocket and live operator commands, turning a fake page into an adaptive fraud session.
News
The Network Was Private. Attackers Used It as a Bridge Into a Power Plant.
A permissive private cellular APN connected a compromised wind farm to a Polish power plant, turning assumed isolation into an attack path.
Microsoft Is Making Phishing-Resistant MFA the Default. Your Exceptions Become the Risk.
Microsoft will retire its Entra SMS and voice authentication service in February 2027, making passkey migration and exception governance urgent.
The Browser Session Wasn’t Stolen. The Attacker Drove It From Inside the Mac.
AmnesiaStealer clones an authenticated Chromium profile, launches it in a hidden process and gives a remote operator live control from inside the infected Mac.
The Core Platform Wasn’t Breached. 1.6 Million People Were Still Exposed.
RingCentral’s core platform was not breached, yet 1.6 million people were exposed. The incident shows why organisational security extends beyond production infrastructure.
Patching vCenter Is Not Enough Once the Attacker Owns the Control Plane
A vCenter compromise turns patching into incident response. Patch CVE-2026-59310, hunt reverse_ssh persistence and re-establish control-plane trust.
The Supply-Chain Attack Was Bigger Than the Package Everyone Blamed
The LiteLLM supply chain attack began upstream in Trivy. Trusted security tooling, stolen secrets and automated CI/CD turned one breach into a wider exposure graph.
GeoServer Was Probed Before the Patch Arrived
Attackers probed the GeoServer SQL injection before urgent fixes arrived. Patch 3.0.1, 2.28.5 or 2.27.6, then investigate the pre-patch exposure window.
Apple Patched Screen Sharing. Internet-Exposed Macs Were Already Being Hunted.
Apple patched CVE-2026-65400, but attackers were already exploiting internet-exposed macOS Screen Sharing services. The reported compromises reached root and installed Monero miners, turning a patching story into an attack-surface and incident-response problem.
SAP Gave Customers Three Days. Attackers Did Not Need a Public Exploit.
Exploit attempts hit SAP Commerce Cloud honeypots three days after patch day, before any public proof of concept. CVE-2026-58231 shows why internet-facing enterprise systems need an incident path, not a routine patch window.